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FOREWORD 


This  In-Space  Propellant  Logistics  and  Safety  Study  was  performed  by 
the  Space  Division  of  North  American  Rockwell  Corporation  for  the  National 
Aeronautics  and  Space  Administration,  Marshall  Space  Flight  Center,  under 
Contract  NAS8-27692.  The  study  was  a twelve-month  effort  initiated  on 
June  25,  1971,  and  completed  on  June  23,  1972. 

The  study  was  conducted  as  two  separate,  but  related  projects.  One 
project  addressed  the  systems  and  operational  problems  associated  with  the 
transport,  transfer,  and  storage  of  cryogenic  propellants  in  low  earth  orbits, 
while  the  other  project  addressed  the  safety  problems  connected  with  In- 
space  propellant  logistics  operations.  Correlation  between  the  two  projects 
was  maintained  by  including  safety  considerations  resulting  from  the  System 
Safety  Analysis  in  the  trade  studies  and  evaluations  of  alternate  operating 
concepts  in  the  Systems /Operations  Analysis. 

Walter  E.  Whltacre  of  Marshall  Space  Flight  Center,  Advanced  Systems 
Analysis  Office,  was  the  Contracting  Officer's  Representative  and  provided 
technical  direction  to  the  overall  contract  and  to  the  Systems /Operations 
Analysis  project;  Walter  Stafford  of  the  same  office  provided  technical 
direction  to  the  System  Safety  Analysis  project.  The  contractor  effort  was 
under  the  direction  of  Robert  E.  Sexton,  Program  Manager;  the  Systems/ 
Operations  Analysis  effort  was  led  by  Robert  L.  Moore  and  the  System  Safety 
Analysis  effort  was  led  by  William  E.  Plaisted.  Key  technical  contributors 
were  G.  F.  Ruff,  System  Safety  Analysis  and  Trade  Studies,  and  J.  R.  Cook, 
Literature  Review,  Preventive  Measures,  and  Guidelines  and  Requirements. 

This  document  is  Volume  III  of  the  following  three  volumes  which 
contain  the  results  of  the  System  Safety  Analysis: 


Volume 

I 

Executive  Summary 

(SD72-SA-0054-1) 

Volume 

II 

System  Safety  Guidelines 
and  Requirements 

(SD72-SA-0054-2) 

Volume 

III 

System  Safety  Analysis 

(SD72-SA-0054-3) 

The  results 
contained  in  the 

of  the  Systems/Operations  Analysis  portion  of  the  study  are 
following  five  volumes: 

Volume 

I 

Executive  Summary 

(SD72-SA-0053-1) 

Volume 

II 

Technical  Report 

(SD72-SA-0053-2) 

Volume 

III 

Trade  Studies 

(SD72-SA-0053-3) 

Volume 

IV 

Project  Planning  Data 

(SD72-SA-0053-A) 

Volume 

V 

Cost  Estimates 

(SD72-SA-0053-5) 
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This  volume  contains  the  System  Safety  Analysis  of  operations  wherein 
propellants  are  1)  transported  Into  space  for  subsequent  use  by  another 
vehicle,  2)  stored  In  space  for  later  use,  and/or  3)  transferred  from  one 
element  to  another  In  space.  Representative  orbital  logistic  operations 
are  developed,  hazards  are  Identified,  and  preventive  measures  are  described 
which  reduce  catastrophic  and  critical  hazards  to  marginal  or  negligible. 
Hazards  not  reduced  to  this  level  are  Identified  as  residuals.  Safety 
evaluation  trade  studies  of  propellant  transfer  concepts  are  Included. 
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1.0  INTRODUCTION 

1 . 1 BACKGROUND 

The  National  Aeronautics  and  Space  Administration  space  program  plan 
(1975-1995)  encompasses  a multitude  of  elements  Including  space-based 
vehicles  for  transporting  payloads  from  low  earth  orbit  to  geosynchronous, 
lunar  and  planetary  orbit.  These  space-based  vehicles  require  large 
quantities  of  propellants  (primarily  liquid  oxygen  and  liquid  hydrogen)  and 
an  In-space  propellant  logistics  element  to  provide  earth-to-earth  orbit 
transport,  earth  orbital  storage  and  In-space  transfer  of  these  propellants. 
Many  of  the  routine  operations  required  of  the  propellant  logistic  system 
are  as  yet  undeveloped  and  are  potentially  hazardous.  A vital  step  In  the 
successful  execution  of  the  space  program  plan  Is  the  conduct  of  a system 
safety  analysis  of  the  propellant  logistic  operations.  This  has  been 
accomplished  and  Is  reported  In  this  document. 

1 . 2 STUDY  OBJECTIVES 

The  primary  objective  of  the  study  was  to  examine  from  a system  safety 
viewpoint  the  in-^space  propellant  logistic  elements  and  operations  to  define 
the  potential  hazards  and  to  recommend  means  to  reduce,  eliminate  or  control 
them. 


A secondary  objective  was  to  conduct  trade  studies  of  specific  systems 
or  operations  to  determine  the  safest  of  alternate  approaches. 

1.3  STUDY  SCOPE  AND  REPORT  ORGANIZATION 

The  study  Includes  the  safety  evaluation  of  operations  wherein 
propellants  are  1)  transported  Into  space  for  subsequent  use  by  another 
vehicle,  2)  stored  In  space  for  later  use,  and  or  3)  transferred  from  one 
element  to  another  In  space.  The  evaluation  encompasses  potential 
elements  which  have  received  serious  consideration  by  NASA  In  the  time 
period  1975-1995.  This  broad  scope  has  resulted  In  a very  large  amount  of 
data  which  are  usable  and  useful  to  those  who  will  ultimately  be  charged 
with  the  design,  development  or  operation  of  future  space  elements.  Certain 
of  these  detailed  data  will  be  of  Interest  to  some,  other  data  will  be  use- 
ful to  others.  All  of  the  data  will  be  of  Interest  to  System  Safety  Engineers. 

An  explanation  of  the  organization  of  this  volume  Is  presented  to  assist 
In  the  best  utilization  of  the  data  accumulated  during  the  study. 

Figure  1.3-1  Is  a schematic  representation  of  the  flow  of  data  through- 
out the  study  and  Indicates  the  points  at  which  the  data  accumulates  In  this 
volume . 
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This  document  Is  structured  to  preserve  all  the  data  and  yet  provide  for 
rapid  review  of  the  entire  scope  by  presenting  the  results  In  four  levels  of 
depth,  each  level  providing  increasing  detail  and  reinforcing  the  previous 
level . 


The  first  level  provides  the  reader  an  overview  of  the  entire  study  in 
Section  2.0  Study  Approach  and  Summary. 


The  second  level  provides  a summary  of  the  technical  discussion  at  the 
beginning  of  each  of  the  following  sections : 


Section  3.0 
Section  4.0 
Section  5.0 
Section  6.0 


Representative  Orbital  Logistics  Operations 
Hazard  Analysis 
Preventive  Measures 
Trade  Studies 


The  third  level  provides  the  technical  discussion  for  each  of  these 
sections . 

The  fourth  level  of  Information  presents  the  following  appendices  of 
data  In  support  of  the  detailed  study  activities. 

Appendix  A Representative  Orbital  Propellant  Logistics  Operations  and 
Functional  Flow  Diagrams 


Appendix  B 
Appendix  C 
Appendix  D 
Appendix  E 
Appendix  F 
Appendix  G 
Appendix  H 
Appendix  I 


FMEA's 

Hazard  Analysis  Sheets 
Preventive  Measures 
Safety  Criteria 

Conditions  Contributing  to  Hazards 
Safety  Evaluation  of  Slush  Hydrogen 
Literature  Review  Reference 
List  of  Abbreviations  and  Definitions 
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2.0  STUDY  APPROACH  AND  SUMMARY 

2.1  STUDY  APPROACH 

A space  program  model  for  the  system  safety  analysis  of  the  In-space 
propellant  logistic  operations  was  established.  It  was  the  Intent  to 
establish  a model  which  Involved  all  conceivably  credible  propellant  logistic 
operations.  The  space  program  elements.  Figure  2.1-1,  considered  were: 

Space-Based  Propellant  User  Vehicles 

- Tug 

- CIS/RNS 

- Modular  User  (special  case) 

- Shuttle  Orblter  (special  case) 

Earth-to-Earth  Orbit  Transport  Modes 

- Shuttle  Orblter  Cargo  Bay 

- Shuttle  Booster  with  Expendable  Second 

Propellant  Elements 

- Propellant  Logistic  Module  for  Shuttle 

- Large  Propellant  Logistic  Tank  for  ESS 

- Large  Orbital  Storage  Facility  (LSF) 

The  study  baseline,  Figure  2.1-2',  consisted  of  a 
storage  facility  (LSF)  which  was  re-supplied  from  a propellant  module  (PM) 
carried  In  the  shuttle  cargo  bay;  the  space-based  tug  and  CIS/RNS  user 
vehicles;  and  fluid  flow  propellant  transfer  utilizing  rotational  accelera- 
tion for  settling  of  the  propellants  during  the  transfer  operation,  both 
from  the  propellant  logistics  module  to  the  LSF  and  from  the  LSF  to  the 
user  vehicles.  The  initial  assembly  of  the  LSF  is  included  In  the  baseline. 
The  baseline  model  Included  two  alternative  earth-to-earth  orbit  propellant 
transport  techniques  which  expanded  the  operations  for  analysis  somewhat: 

1)  Delivery  of  the  PM  in  the  shuttle  cargo  bay  to  one  orbital 
altitude  and  transfer  of  the  PM  to  the  LSF  at  a higher  altitude 
using  the  space-based  tug. 

2)  Delivery  of  a large  quantity  of  propellants  directly  to  the 
CIS/RNS  using  the  shuttle  booster  with  an  expendable  second 
stage  as  the  transport  mode. 

Functional  flows  depleting  the  operation  of  the  baseline  were  developed 
and  from  these  the  propellant  logistic/ transfer  related  operations  were 
Isolated.  The  propellant  operations  were  evaluated  in  detail  to  establish 
hardware  and  procedural  failure  modes  and  effects  and  documented  on  FMEA 


Stage  (ESS) 

Cargo  Bay 
Delivery 

large  earth  orbital 
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Figure  2.1-1  Propellant  Logistics  Elements 
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forms.  From  that  evaluation  the  propellant  related  hazards  were  Identified 
and  each  of  these  were  analyzed  in  detail  and  documented  on  Hazard  Analysis 
forms.  Unique  ground  operations  were  included  in  this  analysis.  For  each 
hazard,  preventive  measures  were  recommended  on  the  same  form. 

Careful  review  and  correlation  of  the  baseline  model  analysis  results 
provided  these  significant  observations: 

1.  The  critical  operations  were  represented  by  seven  categories  of 
representative  orbital  operations  as  shown  by  the  top  three  rows 
of  Table  2.1-1. 

2.  The  hazards  fell  Into  fifteen  basic  categories  for  deployment, 
docking,  transfer  and  retrieval  In  propellant  logistics  operations. 
These  are  shown  In  Table  2.1-2. 

Examination  of  the  space  program  plan  led  to  the  following  additional 
operations  not  Included  In  the  baseline  model  as  representative: 

1.  Orblter  to  orblter  Introduces  the  use  of  flex  lines  and  positive 
expulsion  for  prop.ellant  transfer. 

2.  Orblter  to  tug  brings  out  the  use  of  rotational  mechanisms  for 
deployment,  and  rotational  and  linear  acceleration  with  a manned 
vehicle  (orblter)  attached. 

3.  Orblter  to  CIS/RNS,  Figure  2,1-3,  employs  the  additional  operation 
of  the  orblter  hard  docking  a propellant  module  to  a large, 
partially  full  vehicle,  the  linear  acceleration  of  a large  CIS/RNS 
and  propellant  tank  module  and  capillary  fluid  control. 

4.  Orblter  to  modular  user  adds  the  operation  of  a module  being 
deployed  by  both  rotational  and  manipulator  mechanisms. 

The  Inclusion  of  these  on  Table  2.1-1  brings  the  total  number  of 
representative  propellant  logistics  operations  to  16. 

In  the  application  of  Preventive  Measures,, the  Hazard  Reduction  Pro- 
cedure Sequence  of  SPDl-A  was  followed.  The  steps  taken  were  In  this  order: 

1)  Design  the  hazard  out 

2)  or.  Use  Safety  Devices 

3)  or.  Use  Warning  Devices 

4)  or.  Develop  Special  Procedures 

The  only  hazards  addressed  In  the  preventive  measures  analysis  were 
those  Initially  classed  as  catastrophic  and  critical.  If,  In  the  application 
of  preventive  measures,  the  hazard  was  not  reduced  to  below  the  level  of 
critical,  the  hazard  was  a residual  one.  Thirty-three  residual  hazards  were 
so  Identified.  The  predominant  residual  hazards  are  those  dealing  with 
overall  vehicle  dynamics,  EVA  operations,  propellants  venting  into  cargo  bay, 
and  excess  landing  weight. 
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Table  2.1-1  In-Space  Propellant  Logistics  Safety  Critical  Operations 


DEPLOYMEKT 


PROPELLANT  TANK 
NODULE  DEPLOYED 
BY  MANIPULATORS 
FROM  CARGO  BAY 


MODULE  DEPLOYED 
BY  ROTATIONAL  t 
MANIPULATOR 
MECHANISMS 


SHUTTLE  SOFT  DOCKS 
PROPELLANT  TANK 
MODULE  TO  LSF 

REMOTE  HARO  DOCK 
CIS  TO  LSF 


REMOTE  HARO 
DOCK  TUG/MODULE 
TO  LSF 


REMOTE  HARD  DOCK 
OF  LARGE  PROPEL- 
LANT TANK  WITH 
CIS/RNS 


ORBITER 
PROPELLANT  TANK 
MODULE  TO  CIS/RNS 


TRANSFER 


ROTATIONAL  ACCELERATION  OF  PROPELLANT  TANK  RETRIEVAL - 
LSF  FOR  PROPELLANT  SEHLING  - EMPLACEMENT  IN  CARGO  BAY  S 
CIS/RNS  - ORBITER  UNAHACHED  OEORBIT  OF  ORBITER 


FLEK  LINES  USED  BY 
AnACHINF  AT  QD  WITH 
USE  OF  MANIPULATORS 


POSITIVE  DISPLACEMENT 
METHOD  USED  FOR  PRO- 
PELLANT TRANSFER 


ACCELERATION  FOR 
PROPELLANT  SETTLING 
WITH  ORBITER  AHACHEO 


CIS/RNS/TANK  MODULE  PRO 
PELLANT  SETTLING  WITH  • 
ORBITER  NOT  ATTACHED 


Table  2.1-2  Propellant  Logistic  Operations  Hazards 


1.  FIRE/EXPLOSION/ IMPLOSION 

2.  REDUCED  INTEGRITY  OF  STRUCTURE 
OR  EQUIPMENT 

2-1  LOSS  OF  PRESSURIZATION  CONTRa 
2-2  THERMAL  SHOCK 
2-3  FAILURE  OF  LINE  INTERCONNECT 
FIXTURE 

2-4  LEAKAGE  OR  MASS  SPILL 
2-5  LOSS  OF  LIQUID  VAPOR  INTERFACE 
CONTRa 

2-6  DEGRADATION  OF  MANNED  CEMENTS 

3.  CONTAMINATION 

8.  IMPACT 

9.  LOSS  OF  AHITUDE  CONTRa 

11.  LOSS  OF  COMMUNICATIONS 

12  DISTURBANCES 
12-1  SLOSHING 
12-2  DYNAMIC  COUPLING 
12-3  LOSS  OF  CG  CONTRa 
12-4  UNCONTRaLED  VENTING 


DOCKING  TRANSFER  RETRIEVAL 
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One  of  the  objectives  of  the  System  Safety  Analysis  was  to  conduct  trade 
studies  of  candidate  systems  concepts  and  modes  in  order  to  recommend  the 
safest  among  competing  options.  In  each  of  several  subjects  the  methods  and 
criteria  used  for  evaluation  are  presented.  The  subjects  studied  are: 

1)  Safety  Evaluation  of  Manipulator  and  Rotational  Deployment  Mechanisms 

2)  Safety  Evaluation  of  Orbiter  Attached  and  Orbiter  Not  Attached  for 
Propellant  Transfer 

3)  Safety  Comparison  of  Four  Tug  Propellant  Transfer  Concepts 

4)  Safety  Comparison  of  Four  CIS/RNS  Transfer  Concepts 

5)  Safety  Evaluation  of  a Modular  Concept  - CIS/RNS  Type 

6)  Safety  Evaluation  of  Orblter-to-Orblter  Transfer 

Additional  details  of  the  options  considered,  the  manner  In  which  they 
are  used,  and  the  criteria  used  to  make  the  evaluation  are  contained  in 
Section  6.0  of  this  report. 

2.2  SUMMARY 

The  sixteen  Representative  Orbital  Logistics  Operations  involving  deploy- 
ment, docking,  transfer  and  retrieval  (see  Table  2.1-1)  were  investigated 
for  a combination  of  fifteen  hazard  groups  and  subgroups  (see  Table  2.1-2) 
and  conditions  contributing  to  these  hazards  were  identified  In  Section  4.0,  .. 
Hazard  Analysis. 

As  the  Hazard  Analysis  progressed,  it  became  evident  that  a greater  level 
of  analysis  was  required  for  several  critical  areas.  The  first  of  these 
critical  areas  Involves  the  shuttle  orbiter  and  the  hazards  associated  with 
propellant  logistic  elements  in  the  cargo  bay.  These  Include: 

The  unique  prelaunch  cargo  bay  operations  involving  loading 
of  slush  or  liquid  hydrogen  into  the  propellant  logistic 
element  In  the  cargo  bay. 

The  orbital  cargo  bay  operations  involving  deployment  of  elements 
out  of  the  bay,  docking,  transfer  and  retrieval. 

Another  critical  area  involves  the  effect  of  propulsive  venting  on 
element's  control  during  propellant  logistic  operations. 

The  last  critical  area  investigated  involved  the  abort  considerations. 

Analysis  of  the  prelaunch  cargo  bay  operations  disclosed  the  requirement 
for  the  sequential  loading  of  propellants  (LOX  first,  then  LH2) , the  need 
for  the  provision  of  propellant  off-load  capability  and  propellant  dump 
capability.  Loading  of  slush  hydrogen  can  be  achieved  by  pumping  the  slush 
through  highly  Insulated  facility  lines  directly  Into  the  propellant  tanks 
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of  the  logistic  element  in  the  cargo  bay.  The  module  can  also  be  filled  at 
the  slush  facility  and  then  transferred  to  the  cargo  bay.  Heat  input  into 
the  lines  can  produce  llqulf icatlon  of  the  slush  which  can  lead  to  slug  flow. 
The  operation  of  transporting  a module  loaded  with  slush  to  the  cargo  bay 
is  especially  hazardous  because  remote  handling  is  not  practical.  Problems 
with  the  insulation  could  initiate  a potential  fire/explosion  condition. 


The  hazards  associated  with  orbital  cargo  bay  operations  Involve  collisions 
or  vehicle  instability  from  loss  of  control  and  sloshing.  The  deorbit  phase 
of  cargo  bay  operations  and  the  preparation  to  the  propellant  module  for  re- 
entry are  critical  to  the  safety  of  the  orblter  and  crew.  An  evaluation  of 
hydrogen  leakage  into  the  cargo  bay  shows  the  propellant  elements  can  be  safely 
deorblted  in  the  cargo  bay  if  the  necessary  precautions  are  taken.  These 
precautions  would  include  the  examination  of  propellant  consumption  records 
and  a visual  Inspection  of  the  module  for  leakage  prior  to  emplacement  in 
the  cargo  bay.  A visual  inspection  should  also  be  made  of  the  cargo  bay 
walls.  When  the  module  is  placed  in  the  cargo  bay  it  should  be  securely 
attached  to  its  mounting  points  and  vent/dump  interface.  The  vent/dump 
connection  should  next  be  leak  checked  to  determine  connection  Integrity. 


The  next  step  would  be  to  dump  the  residual  liquids  from  the  propellant 
tanks  and  to  make  a gross  leak  check  of  the  entire  hydrogen  system.  If  no 
leakage  exceeding  specification  requirements  was  evident  from  these  tests, 
the  module  can  safely  be  deorblted  because  normal  (within  specifications) 
leakage  is  not  hazardous.  If  out  of  specification  leakage  is  evident,  then 
the  module  should  be  left  in  orbit  until  corrective  action  can  be  taken. 

Out  of  specification  leakage  in  the  cargo  bay  can  lead  to  a buildup  of 
solidified  hydrogen  on  the  walls  of  the  bay.  Under  deorblt  conditions  the 
mixture  of  this  hydrogen  with  the  oxygen  in  the  atmosphere  and  the  potential 
ignition  sources  make  f Ire/exploslon  a credible  hazard.  An  investigation 
of  the  time  necessary  to  sublime  the  solidified  propellants  determined  that 
with  the  orblter  cargo  bay  orientated  to  allow  maximum  solar  heating,  a worst 
case  credible  spill  could  be  removed  from  the  bay  in  two  hours. 

Abort,  under  worst  case  time  conditions,  will  require  the  dump  of  a max-1  mum 
of  25K  lb.  of  propellants  in  200  seconds  to  meet  the  40K  lb.  landing  require- 
ment of  the  orblter. 

An  Integral  part  of  System  Safety  analysis  is  the  development  of  preven- 
tive measures  to  reduce  hazard  potential.  As  a part  of  the  hazard  analysis 
process  the  hazard  was  identified  and  the  conditions  that  caused  the  hazard  to 
exist  or  occur  were  enumerated.  It  follows,  then,  that  if  the  conditions  that  led 
to  the  hazard  were  corrected  by  preventive  measures  the  hazard  would  not  occur. 

In  the  application  of  Preventive  Measures  the  Hazard  Reduction  Precedence 
Sequence  of  SPDl-A  was  followed.  The  steps  taken  were  in  this  order: 
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a.  Design  the  hazard  out 

b.  or.  Use  Safety  Devices 

c.  or.  Use  Warning  Devices 

d.  or.  Develop  Special  Procedures. 

The  only  hazards  considered  In  the  analysis  were  those  classed  as  catastrophic 
and  critical.  If,  In  the  application  of  preventive  measures.,  the  hazard  was 
not  reduced  to  below  the  level  of  critical  the  hazard  was  classed  a residual 
one.  Thirty-three  residual  hazards  were  so  Identified. 

Among  the  residual  hazards  are  those  dealing  with  overall  vehicle 
dynamics,  EVA  operations,  propellants  venting  Into  cargo  bay,  excess  landing 
weight  and  others  that  are  listed  In  Section  5.0  and  Appendix  F. 

One  of  the  objectives  of  the  System  Safety  Analysis  was  to  conduct 
trade  studies  of  candidate  systems,  concepts  and  modes  In  order  to  recommend 
the  safest  among  competing  options.  In  each  of  several  subjects  the  methods 
and  criteria  used  for  evaluation  are  presented.  The  subjects  studied  and 
the  result  of  the  trades  are: 

a.  Safety  Evaluation  of  Manipulator  versus  Rotational  Deployment 
Mechanisms  - The  trade  established  no  clear-cut  advantage  In  using 
either  type  of  mechanism. 

b.  Safety  Evaluation  of  Orblter  Attached  versus  Orblter  Not  Attached 
for  Propellant  Transfer  - It  was  concluded  that  there  were  greater 
requirements  for  safety  with  the  orblter  attached. 

c.  Safety  Comparison  of  Four  Tug  Propellant  Transfer  Concepts  - The 
concept  of  leaving  the  tank  In  the  cargo  bay  and  docking  to  the 
side  of  the  tank  was  the  preferred  approach. 

d.  Safety  Comparison  of  Four  CIS/RNS  Transfer  Concepts  - The  preferred 
propellant  transfer  mode  was  with  the  CIS/RNS  and  module  attached 
and  linearly  accelerated  for  transfer. 

e.  Safety  Evaluation  of  a Modular  Concept,  CIS/RNS  Type  - The  safety 
evaluation  of  such  a concept  Indicates  It  to  be  competitive  with 
the  non-modular  approach. 

f.  Safety  Evaluation  of  Orblter-to-Orblter  Transfer  - Of  the  three 
approaches  Investigated,  no  safety  preference  could  be  defined. 

As  the  configuration  reaches  maturity  additional  trades  should  be 
conducted. 

Additional  details  of  the  options  considered,  the  manner  In  which  they 
are  used,  and  the  criteria  used  to  make  the  evaluation  are  contained  In 
Section  6.0. 


- 11  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


Section  7.0  of  Volume  III  contains  the  conclusions  that  were  reached  by 
performing  the  System  Safety  Analysis  of  propellant  logistics  operations. 
Among  these  conclusions  are: 

a.  Propellant  delivery  direct  to  a user  without  storage  is  a safer 
concept  than  with  storage  because  of  the  reduction  of  the  complexity 
of  the  operations. 

b.  Deployment  of  a propellant  logistics  element  from  the  cargo  bay 
should  be  accomplished  with  a combination  of  the  manipulator  and 
rotational  deplo3rment  mechanisms. 

c.  Modular  transfer  of  propellants  to  a modular  user  is  a recommended 
concept. 

d.  The  effect  of  disturbances  on  vehicle  control  systems  during 
propellant  logistics  operations  is  a residual  hazard. 

Other  conclusions  are  contained  in  Section  7.0. 

Volume  III  concludes  with  recommendations  for  additional  study. 

a.  Through  the  loss  or  degradation  of  insulation  the  tank  walls  of  a 
module  can  develop  hot  spots.  Upon  re-entry  residual  propellants 
could  contact  these  hot  spots  and  flash  into  vapor.  This  sudden 
Increase  in  pressure  could  exceed  the  capability  of  the  vent 
system  and  lead  to  tank  over-pressures  or  rupture.  The  capability 
of  the  chosen  systems  to  overcome  this  hazard  should  be  resolved. 

b.  The  overall  dynamics  of  the  propellant  logistics  system  should  be 
studied  to  determine  the  effects  of  sloshing,  vehicle  compliance, 
coupling  and  other  forces  on  the  ability  to  maintain  vehicle 
stability. 
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3.0  REPRESENTATIVE  ORBITAL  PROPELLANT  LOGISTIC  OPERATIONS 

This  section  covers  the  development  of  representative  orbital  propellant 
logistics  operations  from  which  hazards  were  identified  for  analysis.  Pro- 
pellant logistic  elements  and  missions  that  were  viable  options  were  con- 
sidered, resulting  in  selection  of  a baseline  concept.  The  buellne  concept 
consists  of  an  orbiter  delivering  a propellant  tank  asdule  to  a Largo  Storage 

Facility  (L8F) . from  which  orbital  user  elements  such  as  CIS/BHS  and  tug  were 

supplied  propellants.  Rotational  acceleration  was  the  mode  used  for  propellant 
settling  during  transfer  operations. 

Variations  to  the  baseline  which  added  critical  operations  not  contained 
in  the  baseline  were  (1)  the  tug  added  to  the  delivery  mode  in  the  baseline, 

(2)  Booster/ESS/large  propellant  tank  as  a delivery  element  to  CIS/RNS,  and 

(3)  the  orblter  delivery  of  propellants  direct  to  users,  such  as  an  orblter, 
tug,  CIS/RNS  or  modular  element. 

Major  critical  on-orbit  operations  of  deployment,  docking,  transfer,  and 
retrieval,  and  unique  ground  operations  involving  handling  of  slush  hydrogen 
and  filling  logistics  elements  in  the  cargo  bay,  were  evaluated. 

Critical  operations  of  deployment  considered  the  use  of  rotational  and 
manipulator  deployment  mechanisms  singly  and  in  combination.  Docking  con- 
sidered both  soft  and  hard  docking  concepts  with  configurations .loading  both 
small  and  large  quantities  of  propellants.  This  Involved  such  cases  as: 

1.  Orblter  manipulators  soft  dock  a propellant  tank  module ‘ to  a large 

storage  facility  with  varying  quantities  of  propellants. 

2.  Empty  CIS/RNS  hard  docks  to  a large  storage  facility  with  varying 
quantities  of  propellants. 

3.  Tug  with  full  propellant  tank  module  hard  docks  to  large  storage 
facility  with  varying  quantities  of  propellants. 

4.  ESS/large  propellant  tank  hard  docks  to  large  empty  CIS. 

5.  Orblter  hard  docks  a propellant  tank  module  to  a CIS/RNS  with 
varying  quantities  of  propellants  in  tanks. 

Critical  transfer  operations  considered  rotational  and  linear  accelera- 
tion for  propellant  settling  and  use  of  capillary  or  positive  expulsion 
devices.  These  involve  such  cases  as: 

1.  Rotation  with  propellant  tank,  LSF  and  CIS/RNS 

2.  Rotation  with  orbiter/propellant  tank/ tug 

3.  Rotation  with  orbiter/propellant  tank  and  CIS/RNS 
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4.  Linear  with  orbiter/propellant  tank/ tug 

5.  Linear  with  propellant  tank/CIS  or  RNS 

6.  Capillary  with  propellant  tank/CIS  or  RNS 

7.  Propellant  tank  transfer  to  a modular  element  (CIS  type) 

8.  Positive  displacement  through  flex  lines  - orblter  to  orblter 

Critical  operations  of  retrieval  considered  use  of  manipulators  and 
direct  hard  docking  for  retrieval  of  empty  propellant  tank  modules,  and  those 
operations  of  stowing  the  module  in  the  orblter  cargo  bay  and  deorbit.  This 
Involves  such  cases  as: 

1.  Manipulator  emplacement  of  propellant  tank  module  into  the  orblter 
cargo  bay  and  making  necessary  system -hookup  connections. 

2.  Orblter  hard  dock  to  propellant  tank  module  on  CIS  using  rotational 
deployment  mechanism  and  subsequent  undocking  at  the  CIS  interface 
with  emplacement  of  the  tank  into  the  cargo  bay. 

3.  For  the  modular  element,  the  empty  tank  module  is  retrieved  by 
manipulator,  docked  to  the  rotational  deployment  mechanism  and 
rotated  into  the  cargo  bay. 

Selection  of  these  representative  orbital  propellant  logistic  operations 
provided  the  study  with  conditions  containing  the  majority  of  hazards  which 
could  be  expected  in  any  propellant  logistic  concept. 

3.1  REPRESENTATIVE  CONCEPTS 

The  development  of  the  representative  orbital  propellant  logistics 
operations  considered  the  propellant  logistics  elements  and  missions  that 
were  viable  options  in  the  space  program.  The  baseline  concept  chosen  for 
determining  the  critical  operations  during  deployment,  docking,  transfer  and 
retrieval  was  the  orblter  delivering  propellants  to  a large  storage  facility 
(LSF)  in  earth  orbit  from  which  other  orbital  elements  such  as  CIS,  RNS  and 
tug  were  supplied  propellants. 

Variations  to  the  bas'ellne  concept,  which  added  operations  not  contained 
in  the  baseline,  involved  the  tug  and  ESS  as  delivery  elements  and  the  orblter 
direct  to  users  including  a modular  element. 

Functional  flow  diagrams  were  prepared  for  the  baseline  concept  and 
added  tug  delivery  concept  and  the  booster/ESS  delivery  concept  for  use  in 
hazard  analysis . 
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3.2  FUNCTIONAL  FLOW  DIAGRAMS 


The  operation  of  the  conceptual  representative  orbital  propellant 
logistic  system  baseline  Is  depicted  In  Figure  3.2-1,  for  the  orblter  to  LSF. 
As  the  baseline  Is  adjusted  for  sharing  delivery  of  the  propellant  tank  module 
with  the  tug,  the  delta  to  the  system  Is  depicted  In  Figure  3.2-2. 


Figure  3.2-1  Baseline  Orblter/OPD/User  Mission  Profile 


Figure  3.2-2  Orblter /Tug/Large  Storage  Facility 
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3.2.1  Orbital  Propellant  Logistic  Functions 

The  representative  orbital  propellant  logistic  functions  will  be  com- 
patible with  the  top-level  functional  flow  diagrams  (FFD's)  (see  Figures 
3. 2. 1-1  for  baseline  and  3. 2. 1-2  for  tug  variation)  listed  below  and  all 
applicable  subfunctions: 

1.0  Perform  Installation  Checkout  Operations 

2.0  Perform  Assembly  and  Launch  to  Orbit 

3.0  Perform  Orbital  Buildup  Operations 

*3.0A  Transfer  Mission  Payload  Delivery  Function  (Tug) 

4.0  Perform  Propellant  Transfer  Operations 

*4.0A  Perform  Propellant  Transfer  Operations  (Tug) 

5.0  Perform  Maintenance  Operations 

6.0  Undock,  Stow  and  Dcorblt/Land 

7.0  Perform  Mission  Abort  Operations 

8.0  Perform  Emergency  Rescue  Operations 

9.0  Deactivate  Propellant  Logistics  Element 

*Baseline  variation  (shuttle/tug  delivery)  denoted  by  the  letter  A. 


The  following  paragraphs  specify  the  activities  and  events  for  each  top- 
level  FFD  associated  with  the  operational  phase.  Functional  flow  diagram 

2.0  addressed  the  unique  operation  of  slush  hydrogen  and  cargo  bay  loading 
operations.  Functional  flow  diagrams  4.0  and  6.0  were  given  maximum  study 
emphasis  because  of  the  orbital  operations  involved.  Abort  considerations 
were  identified  in  FFD  7.0. 


7,0  8.0 


Figure  3. 2. 1-1  Top  Level  Functional  Flow  Propellant  Logistics  System  Elements 

(Shuttle  Alone) 
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Perform  Assembly  and  Launch  to  Orbit  (2.0) . This  function  includes  pre- 
mate checkout,  payload  integration,  vehicle  mating,  transport,  erection, 
propellant  loading,  crew  and  passenger  loading,  final  servicing,  checkout, 
launch  countdown  ignition,  release,  launch,  boost,  staging,  and  orblter 
arrival  at  mission  orbit. 

Perform  Orbital  Buildup  Operations  (3.0) . This  function  covers  all 
activities  associated  with  the  buildup  of  the  Large  Storage  Facility  (LSF) 
including  rendezvous,  equipment  and  support  module  emplacement,  deployment 
and  docking  of  Involved  modules  and  personnel,  activation  and  checkout  of 
subsystems,  undocking,  separation  and  standoff. 

Perform  Transfer  of  Mission  Payload  Delivery  Function  (3.0A) . This 
function  covers  the  initial  space  based  vehicle  deployment  from  the  orbiter, 
propellant  transfer  thereto,  alternative  deployment  of  payload  propulsive 
stage  and  payload,  separation  from  the  delivery  vehicle,  alternative  deploy- 
ment of  propellant  module,  down  modules  and  down  delivery  vehicles  transfer 
to  the  orblter  cargo  bay,  docking  of  propellant  module  to  tug  and  separation 
therefrom. 

Perform  Propellant  Transfer  Operation  (4.0) . This  function  for  the 
orblter  functioning  alone  covers  orbit  and  phase  change,  rendezvous,  de- 
ployment, docking,  transfer  of  propellant  module,  transfer  of  small  pro- 
pellant dewars,  and  retrieval  of  down  propellant  modules. 

Perform  Propellant  Transfer  Operation  (4.0A) . This  function  covers 
orbital  operations  of  the  space  based  vehicle  including  orbit  and  phase 
change,  rendezvous  with  LSF,  docking  of  propellant  module,  undocking, 
maneuvering,  transfer  of  propellants,  retrieval  of  empty  modules,  transfer 
orbit  insertion,  and  rendezvous  with  the  orbiter. 

Perform  Maintenance  Operations  (5.0) . This  function  covers  the  orbiter 
operation  for  performing  maintenance  and  Includes  orbit  and  phase  change, 
rendezvous,  docking,  offloading  of  maintenance  crew,  undocking,  separation, 
station-keeping,  re-docking,  transfer  of  down  modules  and  on-loading  of 
maintenance  crew  and  cargo. 

Undock,  Stow  and  Deorblt/Land  (6.0).  This  function  covers  undocking, 
enplacement  of  module  into  cargo  bay,  securing  module,  configuring  orbiter 
for  deorbit,  retro  maneuver,  re-entry,  atmospheric  flight  subsystems  check- 
out and  configuring,  approach  and  landing. 

Perform  Mission  Abort  Operations  (7.0) . This  function  covers  booster 
and  orblter  pad  and  mated  ascent  abort  operations,  booster  post  separation 
abort,  orbiter  ascent  abort,  orbiter  landing  abort,  and  orbiter  abort  from 
orbit. 

Perform  Rescue  Mission  (8.0).  This  function  Includes  performance  of 
orbit  and  phase  changes,  rendezvous  with  distressed  space  element,  docking, 
attaching  and  loading  rescued  passengers  and  minor  cargo. 
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Deactivate  Propellant  Logistics  Element  (9.0)  . This  function  begins 
with  transport  to  the  saflng  area  and  Includes  post  flight  saflng,  crew  and 
passenger  egress,  cargo  unloading,  transport  to  the  maintenance  hangar. 
Inspection,  post  flight  checkout  and  data  processing,  maintenance,  repair, 
refurbishment,  post-maintenance  checkout,  storage  or  delivery  to  the  premate 
checkout  area.  With  this  set  of  functional  flow  block  diagrams  we  have 
established  the  functions  of  the  logistic  operations  for  delivery  of  pro- 
pellants to  a large  storage  facility. 

3.3  OPERATIONS  - CONCEPTS  FOR  PROPELLANT  LOGISTICS  WITH  STORAGE 

The  following  information  describes  the  representative  orbital  logistics 
operations  which  support  the  use  of  the  large  storage  facility.  The  shuttle 
booster  Is  not  Included  In  these  operations.  See  Appendix  A for  detailed 
operations. 

Ground  and  pad  operations  as  well  as  launch  operations  are  essentially 
the  same  as  for  present  propellant  systems.  The  unique  operations  to  be 
considered  Involve  the  handling  of  slush  and  the  loading/off  loading  of  the 
elements  within  the  cargo  bay  of  the  orblter. 

The  propellant  logistics  elements  are  launched  to  orbit  and  are  assembled 
as  a large  storage  facility  using  a set  of  orbital  buildup  operations.  The 
transport  and  docking  of  equipment,  crew  and  LO2  modules  with  an  orblter  to 
the  large  storage  facility  Is  included  in  these  operations. 

After  assembly  and  activation,  propellant  tank  modules  are  delivered 
to  the  LSF  by  the  orblter  or  the  orbiter/tug  variation. 

The  orblter  propellant  logistics  operations  include  deployment  of  the 
propellant  tank  module  from  the  cargo  bay  and  soft  docking  the  module  to  the 
LSF  using  manipulators. 

The  orbiter/tug  alternate  delivery  mode  logistics  operations  Include 
deplo}nnent  of  the  propellant  tank  module  from  the  cargo  bay,  soft  docking  to 
a tug,  and  tug/propellant  module  remote  hard  docking  to  an  LSF  at  the  higher 
orbit. 

The  unmanned  LSF  Is  rotated  to  provide  propellant  settling  for  the 
transfer  of  propellants  from  the  module  to  the  facility. 

The  orblter  returns  to  the  LSF,  retrieves  and  secures  the  module  in  the 
cargo  bay  and  deorbits  to  earth. 

If  the  orbiter/tug  variation  is  used,  the  tug  acquires  the  module 
from  the  LSF  and  delivers  It  to  the  orblter  which  Is  at  a lower  orbit. 

After  emplacement  of  the  module  in  the  cargo  bay,  the  orblter  deorbits  to 
earth. 

These  delivery  operations  continue  until  the  LSF  is  filled  with  propel- 
lants and  Is  ready  for  refueling  a user  vehicle. 
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User  vehicles.  Chemical  Interorbital  Shuttle  (CIS)  or  Reusable  Nuclear 
Shuttle  (RNS) , are  remotely  hard  docked  to  the  LSF.  The  configuration  Is 
rotated  until  the  users  are  refueled.  After  the  rotation  Is  terminated,  the 
user  undocks  from  the  LSF  and  performs  Its  designated  mission. 

Maintenance  operations  for  the  LSF  Include  the  operations  Involving  the 
equipment  and  crew  modules  at  the  LSF. 

Abort  operations  for  the  orblter  Involve  propellant  dumping  as  a 
function  of  weight  and  time  to  assure  a safe  landing. 

3.4  OPERATIONS  - CONCEPTS  FOR  PROPELLANT  LOGISTICS  WITHOUT  STORAGE 


Concept  variations  for  delivery  of  propellants  direct  to  user  are 
Included  In  this  study  to  complete  the  set  of  representative  orbital  logistics 
operations.  These  concepts  are  Booster/Expendable  Second  Stage/Propellant 
Tank  delivery  direct  to  CIS  or  RNS,  and  orblter  direct  to  orblter,  to  tug, 
to  CIS  or  RNS  and  to  a modular  user. 


3.4.1  Booster/ESS/Large  Propellant  Tank/CIS/RNS,  Figure  3. 4. 1-1 


The  Booster/ESS/Large  Propellant  Tank  concept  was  Investigated  as  a 
delta  to  the  representative  orbital  propellant  logistic  operation  baseline. 
The  operations  Involving  deployment,  docking,  transfer  and  return  to  earth 
(Impact)  were  analyzed  within  the  functions  established  by  top  level 
functional  flow  diagram  presented  In  Figure  3. 4. 1-2.  First  level  functional 
flow  diagrams  are  contained  In  Appendix  A.  This  delta  was  analyzed  for  the 
different  hazards  Involving  operations  where  two  large  tanks  will  be  hard 
docked  by  remote  operational  control. 


Figure  3.4. 1-1  Boostcr/ESS/Lerge  Propellant  Taak/CIS/RMS 
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Figure  3. 4. 1-2  Booster/ESS/CIS/MS 


3.4.2  Orbiter  to  Orblter  Concept  Variation,  Figure  3. 4. 2-1 

The  critical  operations  of  this  variation  are  found  in  the  transfer 
operations  involving  use  of  flex  lines  attached  to  a manipulator  arm  for 
connecting  to  the  airborne  half  of  the  ground  fill  and  drain  quick  disconnect. 
This  variation  also  Introduced  for  the  first  time  the  use  of  a positive  dis- 
placement method  for  propellant  transfer.  Other  operations  of  this  concept 
had  previously  been  analyzed  in  the  baseline  operations . 
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3.4.3  Orblter  to  Tug  Concept  Variation,  Figure  3. 4. 3-1 

This  variation  introduces  critical  deployment  operations  involving  a 
propellant  tank  module  deployed  by  a rotational  deployment  mechanism.  Also 
the  transfer  operations  Introduced  attachment  of  the  orblter  to  the  tug  for 
imparting  a rotational  or  linear  acceleration  for  propellant  settling. 

These  operations  were  again  first  Introduced  by  this  variation  while  other 
operations  had  been  a part  of  the  baseline  concept. 


Figure  3. 4. 3-1  Orblter  to  Tug  Concept  Variation 


- 22  - 


Space  Division 

North  American  Rockwell 


3.4.4  Ofbiter  to  CIS/RNS  Concept  Variation,  Figure  3. 4. 4-1 

This  concept  variation  introduced  a new  docking  operation  wherein  the 
orblter  hard  docks  a propellant  tank  module  to  a large  user;  l.e.,  CIS/RNS. 
Other  variations  from  the  baseline  in  critical  transfer  operations  Involve 
linear  acceleration  for  CIS/RNS/tank  module  propellant  settling  with  the 
orblter  riot  attached  and  capillary  fluid  control  for  CIS/RNS/tank  module 
propellant  transfer.  Other  operations  of  this  concept  had  been  Investigated 
in  the  baseline  analysis. 


Figure  3. 4. 4-1  Orblter  Direct  to  CIS/RNS 
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3. A. 5 Orbiter  to  Modular  User  Concept  Variation,  Figure  3. A. 5-1 

The  operations  of  the  baseline  covered  all  but  the  variation  in  a 
critical  deployment  operation  which  involves  the  deployment  of  a propellant 
tank  module  in  a coordinated  action  involving  both  rotational  and  manipulator 
deplo3rment  mechanisms.  This  concept  Introduced  this  critical  deployment 
operational  variation  for  analysis. 


PROP  MODULES 


/ / 


Figure  3. A. 5-1  Propellant  Transfer  Option  for  Typical  Modular  Concept 


The  above  operations  of  the  baseline  and  baseline  variations  were  the 
basis  for  the  Hazard  Analysis,  discussed  In  the  following  section. 
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4.0  HAZARD  ANALYSIS 

This  section  covers  those  safety  considerations  and  analyses  needed  to 
Identify  hazards  associated  with  the  functions,  elements,  operations,  and 
Interfaces  of  the  baseline  operations  and  variations  to  the  baseline  dis- 
cussed In  Section  3.0. 

Conditions  contributing  to  the  hazards  were  Identified  and  used  In 
examination  of  operations  Involving  the  cargo  bay  area  during  all  phases  of 
the  mission. 

These  examinations  considered  the  loading  of  propellants  Into  the  tank 
modules  while  In  the  cargo  bay,  use  of  deployment  mechanisms,  docking  using 
both  soft  and  hard  dock  methods,  and  retrieval  operations,  which  Include 
return  of  the  tank  module  to  the  cargo  bay,  stowing  and  deorblt  preparation. 
Abort  conditions  were  also  examined.  Propellants  sloshing  In  zero  G present 
the  major  condition  for  Impact,  leakage,  and  vehicle  control  hazards  and 
are  Included  In  the  above  evaluations.  For  details  of  Identified  hazards 
see  Hazard  Analysis  sheets  In  Appendix  C. 

Hazards  associated  with  propellant  logistic  operations,  as  compared  to 
hazards  which  were  general  to  any  orbital  operation,  were  Identified  and 
arranged  by  hazard  group  for  propellant  logistic  operations.  See  Table  4.0-1. 

Conditions  contributing  to  these  hazards  were  developed  for  the  basic 
operations.  The  conditions  contributing  to  deployment  hazards  are  generally 
associated  with  propellant  tank  module  or  logistic  elements.  Where  the 
module  Is  suspended  on  a manipulator,  sloshing  of  propellants  caused  by  RCS 
operation,  undeslred  venting,  or  mass  fluid  spill  causes  Impact  and  vehicle 
control  hazards  to  prevail.  The  spills  or  uncontrolled  venting  In  the  cargo 
bay  leads  to  hazards  of  thermal  shock  and  contamination  of  TV  lens  and  view- 
ing ports  by  Ice  crystal  formation.  Fire  and  explosion  could  occur  wherever 
the  fluids  are  contained  In  concentrations  of  4%  H2  ~ 2%  O2  at  a pressure  of 
2 mm  Hg  or  greater.  Leaks  occurring  when  the  module  Is  extended  on  the 
manipulator  further  cause  attitude  control  problems. 

Docking  hazards  are  generally  associated  with  sloshing,  RCS  action,  or 
venting  causing  misalignment  resulting  in  possible  Impact  or  damage.  Failure 
to  rlgldlze  the  docked  configuration,  while  being  restrained  by  a captive 
latch,  causes  potential  rotation  of  the  elements  from  the  dynamic  coupling  of 
the  elements,  the  RCS  action  and  sloshing  of  the  fluids.  This  hazard  Is  most 
prevalent  during  hard  docking  when  the  orblter  is  attached,  and  less  prevalent 
where  a soft  dock  Is  made  with  manipulators. 


Transfer  hazards  are  generally  involved  with  dynamic  control  of  the  docked 
configurations.  These  hazards  Include  CG  excursion,  dynamic  coupling  of  the 
structure,  fluid  surface  distortion  and  uncontrolled  venting.  Failures  In  the 
gas  generators  or  heat  exchangers  could  cause  fire  or  explosion  hazards. 
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Loss  of  the  capability  to  despin,  where  the  orbiter  Is  attached,  due  to  in- 
stability of  the  configuration  Is  another  type  of  hazard  affecting  the  crew. 

The  predominant  hazards  associated  with  retrieval  operations  are  related 
to  leakage  of  hydrogen  In  the  cargo  bay  during  re-entry.  Any  module  which 
cannot  pass  a leak  check  or  contains  excess  residual  propellants,  which  could 
be  flashed  off  to  exceed  the  tank  relief  capability,  can  cause  f Ire/exploslon 
during  deorb It  and  re-entry.  These  conditions  are  emphased  In  later 
paragraphs . 

An  additional  hazard  closely  related  to  the  above  Is  venting'  in  the 
cargo  bay  during  re-entry.  However,  properly  designed  and  operating  systems 
for  re-connectlng  all  vents  prior  to  re-entry  would  minimize  this  problem. 

An  additional  evaluation  of  cargo  bay  operations  considered  only  unique 
ground  operations  such  as  loading  of  slush  hydrogen  Into  the  propellant  tank 
modules,  the  case  of  series  or  parallel  loading  facility  systems  for  loading 
of  LH2-LO2  Into  the  tank  modules,  and  emergency  offload.  Orbital  operations 
involving  the  use  of  both  rotational  and  manipulator  deplo3rment  mechanisms 
for  hard  and  soft  docking,  respectively,  were  evaluated.  See  Section  6.0 
for  detailed  evaluation. 

Retrieval  operations  were  Investigated  which  dealt  with  the  hazards  of 
attaching  the  module  in  the  cargo  bay  such  that  line  Interconnect  fixtures 
could  be  mated  at  the  tank  module  Interface  with  the  cargo  bay.  Without 
proper  Indexing  this  can  become  a major  problem;  l.e.,  not  capable  of  venting 
the  tank  In  a closed  system  but  rather  divert  to  the  cargo  bay. 

This  venting  or  even  possible  leakage  into  the  cargo  bay  would  be  In 
the  form  of  Ice  crystals  or  snow  which  adheres  to  the  cargo  bay  walls.  It 
will  sublime  away  over  a period  of  hours  with  proper  orbiter  orientation  for 
maxlmim  heating. 

Abort  considerations  are  addressed  in  this  section  and  are  related  to 
sub-orbital  abort,  centered  around  orbiter  abort  and  operational  modes.  They 
relate  specifically  to  off  loading  of  the  orbiter  to  40K  payload  weight  for 
safe  landing.  Greater  payload  landing  weight  can  be  accommodated  however  at 
a lesser  factor  of  safety.  The  operational  mode  wherein  200  seconds  Is 
available  for  orbiter  landing  constrains  the  offload  abort  requirements. 

The  analysis  Identified  hazards  within  the  representative  orbital 
propellant  logistic  operations  which  have  an  Influence  on  the  design  of 
Space  Logistics  Systems.  These  are: 

1.  Location  and  Indexing  of  the  line  Interconnect  fixture  mating 
Interface  (location  of  the  module  attach  points  with  the  cargo  bay 
attach  fitting)  must  be  predetermined  for  each  retrieved  element. 

2.  The  quantity  of  residual  propellants,  which  If  completely  flashed 
off  could  overpressurize  the  tank  module,  must  be  accurately  known 
to  prevent  an  explosion. 
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3.  All  logistic  elements  in  the  cargo  bay  must  be  capable  of  gravity 
feed  off  loading  under  emergency  conditions. 

4.  The  effects  of  disturbances  coupling  with  configuration  dynamics 
must  be  addressed  especially  when  the  orbiter  constitutes  part  of 
the  configuration. 

5.  The  hazard  associated  with  dumping  25K  lbs.  of  propellant  in  no 
inore  than  200  seconds  must  be  considered  from  both  dump  line  size 
and  flame  attenuation  capability  at  the  outlet. 

4.1  ANALYSIS  OF  HAZARD  DATA 

4.1.1  Background 

The  concepts  described  in  Section  3.0  were  analyzed  for  hazards  within 
the  functions  and  space  element  operations  or  interfaces.  See  Appendix  C 
for  definition  of  hazards.  The  functions  and  operations  or  Interfaces  were 
subjected  to  FMEA  development,  which  identified  failures  with  hazard  poten- 
tial. The  FMEA's  are  contained  in  Appendix  B.  Hazards  within  the  baseline 
were  identified,  using  the  FMEA's  and  operations  data.  See  Appendix  C. 
Additional  hazards  were  identified  in  the  arbiter/ tug/LSF  concept  variation 
and  the  booster/ESS/large  propellant  tank  concept.  FMEA's  and  Hazard  Sheets 
were  prepared  for  these  variations.  See  Appendix  B for  FMEA's  and  Appendix 
C for  Hazard  Sheets.  Failures  and  effects  for  the  variations  are  contained 
in  the  Trade  Studies  and  safety  evaluations  in  Section  6.0.  Specific  atten- 
tion was  given  to  orbiter  cargo  bay  operations  in  paragraph  4.2.  Table  2.1-1 
shows  a summary  of  safety  critical  operations  by  concept  and  operational 
phase.  Safety  critical  operations  are  defined  as  those  operations  involving 
systems,  subsystems,  or  components  of  the  space  elements  identified  as  having 
a hazard  potential  to  personnel,  associated  equipment  and  the  space  elements. 

4.1.2  Hazard  Groups 

Identified  hazards  have  been  arranged  by  hazard  groups.  These  groupings 
are  described  in  Appendix  C. 

The  identified  hazards  covered  unique  ground  operations,  launch  and 
ascent,  orbital,  deorblt,  landing  and  saflng  operations.  A filtering 
of  the  hazards  involved  in  orbital  operations  of  deployment,  docking,  trans- 
fer and  retrieval  was  then  made  to  identify  those  hazards  which  were  related 
to  propellant  logistic  operations  alone  as  compared  to  hazards  which  were 
general  to  any  orbital  operation. 

Fifteen  hazards  were  identified  and  related  to  the  critical  operations 
of  deployment^  docking,  transfer,  and  retrieval.  See  Table  4.0-1. 


Conditions  contributing  to  each  hazard  were  identified  and  related  to 
the  safety  critical  operations.  Rationale  is  given  for  each  contributing 
condition  by  operation.  These  hazards  are  addressed  in: 


- 28  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


Table 

4. 1.2-1 

Table 

4. 1.2-2 

Table 

4. 1.2-3 

Table 

4. 1.2-4 

Table 

4. 1.2-5 

Table 

4. 1.2-6 

Table 

4. 1.2-7 

Table 

4. 1.2-8 

Table 

4. 1.2-9 

Table 

4.1.2-10 

Table 

4.1.2-11 

Table 

4.1.2-12 

Table 

4.1.2-13 

Table 

4.1.2-14 

Table 

4.1.2-15 

Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Control  Hazards 
Conditions  Contributing  to 
Rating  Hazards 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 
Conditions  Contributing  to 


Fire  and  Explosion  Hazards 
Pressurization  Hazards 
Thermal  Shock  Hazards 
Line  Interconnect  Hazards 
Leakage/Mass  Spill  Hazards 
Llquid/Vapor  Interface 

the  Degradation  of  Man- 

Contamination  Hazards 
Impact  Hazards 
Attitude  Control  Hazards 
Communication  Hazards 
Sloshing  Hazards 
Dynamic  Coupling  Hazards 
CG  Control  Hazards 
Uncontrolled  Venting  Hazards 


A listing  of  conditions  contributing  to  propellant  logistic  hazards  is 
contained  in  Appendix  F. 

4.2  ORBITER  CARGO  BAY  OPERATIONS  HAZARDS 


The  baseline  delivery  element  for  propellant. logistic  operations  in 
space  is  the  shuttle  orblter  vehicle.  The  major  interface  between  the  space 
elements  and  orblter  is  the  cargo  bay.  It  is  therefore  appropriate  that 
those  operations  directly  relating  to,  and  involving  the  orblter  cargo  bay 
area  be  emphasized.  The  discussion  progresses  through  the  phases  of  pre- 
launch, launch  and  ascent,  orbital,  deorblt  and  abort  operations. 

4.2.1  Prelaunch 

Prelaunch  operations  for  the  propellant  logistic  element  are  generally 
similar  to  those  for  any  large  space  element.  In  this  phase  of  analysis 
consideration  was  given  to  the  type  of  propellant  fill  system  required  to 
load  a propellant  tank  module  while  in  the  orblter  cargo  bay.  An  option 
for  consideration  was  the  use  of  slush  hydrogen  and  attendant  systems.  The 
hazards  associated  with  slush  hydrogen  operations  were  considered. 
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Table  4. 1.2-1 

CONDITIONS  CONTRIBUTING  TO  FIRE  AND  EXPLOSION  HAZARDS 

(Hazard  Group  1) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-1  (Continued) 

CONDITIONS  CONTRIBUTING  TO  FIRE  AND  EXPLOSION  HAZARDS 

(Hazard  Group  1) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-2 

CONDITIONS  CONTRIBUTING  TO  PRESSURIZATION  HAZARDS 
(Hazard  Group  2-1) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-3 

CONDITIONS  CONTRIBUTING  TO  THERMAL  SHOCK  HAZARDS 
(Hazard  Group  2-2) 


Space  Division 

North  American  Rockwell 
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floodlights , 


Table  4. 1.2-4 

COOTilTIOYlS  COOTRIBUTING  TO  LINE  INTERCONNECT  EIXT\JRE  RAZARDS 

(Hazard  Group  2-3) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-4  (Contiiraed) 

CONDITIONS  CONTRIBUTING  TO  LINE  INTERCONNECT  FIXTURE  HAZARDS 

(Hazard  Group  2-3) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-4  (Continued) 

CONDITIONS  CONTRIBUTING  TO  LINE  INTERCONNECT  FIXTURE  HAZARDS 

(Hazard  Group  2-3) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-5 

CONDITIONS  CONTRIBUTING  TO  LEAKAGE/HASS  SPILL  HAZARDS 

(Hazard  Group  2-4) 


Space  Division 

North  American  Rockwell 
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Table  A. 1.2-5  (Coatitiued) 

CONDITIONS  CONTRIBUTING  TO  LEAKAGE/MASS  SPILL  HAZARDS 
(Hazard  Group  2-A) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-5  (Continued) 

CONDITIONS  CONTRIBUTING  TO  LEAKAGE/MASS  SPILL  HAZARDS 

(Hazard  Group  2-4) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-6 

CONDITIONS  CONTRIBUTING  TO  LIQUID/VAPOR  INTERFACE  CONTROL  HAZARDS 

(Hazard  Group  2-5) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-7 

CONDITIONS  CONTRIBUTING  TO  THE  DEGRADATION  OF  MAN-RATING  HAZARDS 

(Hazard  Group  2-6) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-8 

CONDITIONS  CONTRIBUTING  TO  CONTAMINATION  HAZARDS 
(Hazard  Group  3) 


Space  Division 

North  American  Rockwell 
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Table  4. 1.2-9 

CONDITIONS  CONTRIBUTING  TO  IMPACT  HAZARDS 
(Hazard  Group  8) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-10 

CONDITIONS  CONTRIBUTING  TO  ATTITUDE  CONTROL  HAZARDS 

(Hazard  Group  9) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-10  (Continued) 

CONDITIONS  CONTRIBUTING  TO  ATTITUDE  CONTROL  HAZARDS 
(Haeard  Group  9) 


Space  Division 

North  American  Rockwell 
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Venting  The  thrust  produced  by  propulsive  venting  could 

overcome  capability  of  RCS  to  regain  control. 


Table  4.1.2-11 

CONDITIONS  CONTRIBUTING  TO  COMMUNICATION  HAZARDS 
(Hazard  Group  11) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-12 

CONDITIONS  CONTRIBUTING  TO  SLOSHING  HAZARDS 
(Hazard  Group  12-1) 


Space  Division 

North  American  Rockwell 
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Table  A. 1.2-12  (Continued) 

CONDITIONS  CONTRIBUTING  TO  SLOSHING  HAZARDS 
(Hazard  Group  12-1) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-13 

CONDITIONS  CONTRIBUTING  TO  DYNAMIC  COUPLING  HAZARDS 
(Hazard  Group  12-2) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-14 

CONDITIONS  CONTRIBUTING  TO  CG  CONTROL  HAZARDS 
(Hazard  Group  12-3) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-15 

CONDITIONS  CONTRIBUTING  TO  UNCONTROLLED  VENTING  HAZARDS 

(Hazard  Group  12-4) 


Space  Division 

North  American  Rockwell 
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Table  4.1.2-15  (Continued) 
CONDITIONS  CONTRIBUTING  TO  UNCONTROLLED  VENTING 

(Hazard  Group  12-4) 


Space  Division 

North  American  Rockwell 
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4. 2. 1.1  Propellant  Loading  - Propellant  Tank  Module  In  Cargo  Bay 

The  propellant  logistic  element  will  be  loaded  Into  the  cargo  bay  while 
the  orblter  Is  In  the  horizontal  position.  During  this  operation,  the 
propellant  logistic  element  will  be  lowered  and  properly  secured  to  the 
orblter  cargo  bay  attach  points.  Because  of  the  lack  of  volumetric  clearance 
for  a man  In  the  orblter  cargo  bay,  the  remote  monitoring  of  this  operation 
by  TV  aids  is  expected.  The  shuttle  orblter  literature  presently  does  not 
describe  connect  points  In  the  cargo  bay  for  propellant  loading,  pressuriza- 
tion, venting,  etc.  Therefore,  for  purposes  of  this  study,  it  Is  assumed 
there  will  be  a line  Interconnect  fixture  and  venting  system  capable  of  pro- 
viding necessary  services  to  the  propellant  logistic  element  tankage  after 
mounting  In  the  cargo  bay.  These  connections  should  be  ground  checked  for 
leakage  and  should  not  present  any  unique  hazard. 

Once  In  the  vertical  position  on  the  pad,  environmental  control 
(nitrogen  purge)  of  the  cargo  bay  Is  Initiated  which  reduces  the  explosive 
hazards  unless  a major  leak  develops  during  propellant  loading.  This  leak 
occurrence  would  be  a comparable  situation  to  a major  leak  Into  the  Inter- 
stage area  of  the  S-Il/S-IC.  The  question  of  whether  a series  or  parallel 
propellant  loading  technique  Is  used  to  load  the  propellant  tank  module  Is 
therefore  Investigated. 

A discussion  of  conceptual  approach  Is  In  order  relating  to  system 
safety.  Safety  criteria  are  provided  for  use  in  development  of  the  discus- 
sion as  follows: 

a.  The  propellant  loading  operation  for  the  logistic  element  in  the 
cargo  bay  should  be  compatible  with  the  time  line  for  orblter 
loading. 

b.  Fluid  lines  and  connections  shall  be  separated  within  practical 
limits  to  prevent  fluid  vapor  mixing. 

c.  The  cargo  bay  shall  be  purged  by  a gaseous  nitrogen  purge  immediate- 
ly prior  to  and  during  propellant  transfer,  terminating  at  liftoff. 

d.  The  propellant  fill  and  drain  system  for  the  logistic  element  In 
the  cargo  bay  shall  be  sized  and  configured  for  emergency  off  load 
capability,  where  off  load  is  by  gravity  head  and  accomplished  In 
a time  comparable  to  loading  time  or  less. 
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e.  The  line  Interconnect  flxture(s)  will  be  leak  and  pressure  checked 
by  ground  operations  checkout  prior  to  propellant  loading  as  part 
of  the  launch  checkout . 

f.  The  allowable  concentration  in  any  enclosed  area  shall  be  less  than 
2 percent  hydrogen  gas  by  volume  where  personnel  are  not  in  the  pad 
area  and  1 percent  when  they  are  working  in  the  area. 

g.  Hazardous  gas  detection  sensors  shall  provide  data  for  cargo  bay 
leak  detection  and  monitoring  purposes. 

h.  The  propellant  logistic  element  tank  vents  will  be  connected  to  the 
orblter  vent  system  for  disposal  of  vented  hazardous  gasses. 

Factors  bearing  on  the  operation  involve  (1)  the  time  allotted  for 
propellant  loading,  (2)  feed  system  pressure  head  and  loading  rate,  and  (3) 
consideration  of  design  to  accommodate  series  or  parallel  propellant  loading, 
draining  and  emergency  off  load,  etc.  Table  4. 2. 1.1-1  presents  the  safety 
considerations  of  a series  versus  parallel  loading  operation  for  propellant 
logistic  elements  In  the  cargo  bay. 

4. 2. 1.2  Propellant  Loading  - Slush 

The  previous  discussion  Involved  LO2  and  LH2;  however,  a part  of  this 
operation  may  involve  slush  H2.  The  safety  case  for  slush  hydrogen  is  not 
as  well  defined  as  that  for  liquid  hydrogen.  However,  hazards  can  be  identi- 
fied for  the  gross  case  and  further  refinement  of  a complete  slush  hydrogen 
system  must  be  made  before  other  hazards  are  identified  applicable  to  the 
system.  It  is  assumed  the  slush  hydrogen  will  be  manufactured  within  a 
distance  of  two  miles  from  the  launch  pad  with  two  methods  postulated  for 
delivery  to  the  launch  pad  operation:  (1)  by  pumping  through  highly  Insulated 

facility  lines  directly  Into  the  propellant  tank  when  the  tanks  are  located 
In  the  cargo  bay  after  erection  on  the  pad,  and  (2)  by  loading  the  propellant 
module  at  the  slush  manufacturing  location  and  transfer,  with  emplacement  of 
the  tank  In  the  cargo  bay,  at  the  pad  while  maintaining  the  environmental 
conditions  needed  In  the  Insulation  to  prevent  heat  transfer  during  the 
operation.  Both  of  these  methods  have  hazards  which  are  discussed  below. 
Additional  discussions  are  contained  in  Appendix  G. 

a.  Method  1 (Slush  Delivery  by  Pumping  Via  Pipeline) 

Long  line  runs  requiring  super  insulation  capability  afford  the 
potential  for  failure  of  the  insulation  quality  causing  heat  leaks 
and  liqulf Icatlon  of  the  slush  if  not  flowing,  as  during  a hold 
condition.  This  could  lead  to  slug  flow.  At  a critical  velocity 
of  slush  In  a 17  mm  line  (about  0.46  m/sec.)  which  corresponds  to 
a Reynolds  number  of  2.3  X 10^,  Ref.  No.  52,  the  ice  will  settle 
out  of  the  liquid  and  could  cause  line  blockage  due  to  some 
restriction  in  the  system.  This  blockage  could  also  occur  during 
hydrogen  propellant  tank  draining  where  the  outlet  bridges  over 
with  ice  crystals  as  the  fluid  drains  out.  These  residuals  could 
be  hazardous . 
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Table  4. 2. 1.1-1 

SERIES  VS.  PARALLEL  LOADING  PROPELLANT  LOGISTICS 

ELEMENTS 


CONDITION 

SERIES 

LOADING 

POTENTIAL 

RISK 

PARALLEL 

LOADING 

POTENTIAL 

RISK 

COMMENT 

1.  Rate  of  flow  per 
given  time 

Higher 
LO2  & LH2 

Lower 
LO2  & LH^ 

Shorter  time  for  series 
loading  per  fluid  gives 
higher  flow  rate. 

2.  Fire  Potential 

Higher 

Lower 

Greater  amount  of  LO2 
available  per  given  time 
for  reaction  in  aeries 
systahi. 

3.  Explosive  Potential 

Lower 

Higher 

Quantity  of  LH2  per  given 
time  for  mixing  greater  in 
parallel  system. 

4 . Drain  Time 

Lower 

Higher 

Relates  to  larger  line  size 
of  series  system. 

5.  Element  fed  from 

orbiter  LH2-LO2  main 
tankage  propellant 
loading  system 

Lower 

1 

Higher 

Main  system  failure  for 
parallel  loading  presents 
more  hazard  effects. 

6.  Element  fed  from  sep- 
arate propellant  loading 
system 

Lower 

Higher 

Separation  of  fluids 
presents  fewer  hazards 

7.  Potential  mixing  at 
line  interconnect 
fitting  having  LH2  & 
LO2  lines  in  one 
fixture 

Lower 

. 

Higher 

Time  spaced  flow  prevents 
mixing  in  series  loading. 

8.  Potential  mixing  where 
line  interconnect  fix- 
ture has  only  one  LH2 
or  LO2  line  by  use  of 
2 fixtures 

Lower 

Higher 

Time  spaced  flow  plus 
separation  of  lines  best 
in  series  loading. 

9.  Emergency  offload 

through  a fixture  having 
both  LH2  & LO2  lines 

Higher 

* 

Provides  mixture  capability 
leading  to  fire/explosion 
if  purge  fails.  Series 
system  lines  larger. 
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Table  4. 2. 1.1-1 

SERIES  VS.  PARALLEL  LOADING  PROPELLANT  LOGISTICS 
ELEMENTS  (Cont.) 


SERIES  PARALLEL 

LOADING  LOADING 

POTENTIAL  POTENTIAL 

CONDITION  RISK  RISK  COMMENT 

10.  Emergency  offload  Lower 

through  2 fixtures, 
each  having  one 
propellant  line; 
i.e.,  LH2  or  LO2 

11.  Combination  of  2 & 9 Higher  * Greater  than  12  while  in 

earth's  atmosphere 

12.  Combination  of  2 & 10  Lower  * Least  risk  for  ground 

operations 

OVERALL  RISK  Lower  Higher 

*In  emergency  off loadings,  parallel  offloading  through  separate 
series  systems  would  be  used. 


Greatly  reduces  mixing 
potential  in  case  of  purge 
failure.  Series  system 
line  larger. 
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Where  the  Insulation  heat  leak  allows  the  slush  to  reach  the  triple 
point,  the  expansion  of  the  hydrogen  slush  to  liquid  (approximately 
16  percent  for  50%  slush,  Ref.  No.  12)  could  be  expected  to  cause 
two-phase  (gas  and  liquid)  flow  In  the  vent  system.  [The  hazard  Is 
the  system  may  not  be  designed  to  take  this  two-phase  flow.] 

b.  Method  2 (Slush  Delivery  by  Module) 

Low  thermal  conductivity  Insulation  environment  would  have  to  be 
maintained  on  the  propellant  tank  module  through  the  entire  period 
from  loading,  cargo  bay  Installation,  and  launch.  The  f Ire/ explosion 
potential  In  case  of  failure  during  a manual  operation  Is  too  hazard- 
ous and  should  be  prohibited.  The  fact  that  the  module  may  be  con- 
trolled and  emplaced  In  the  cargo  bay  by  automatic  means  does  not 
lessen  the  f Ire/exploslon  hazard.  A hold  for  a long  period  of  time 
or  ground  abort  condition  could  Initiate  conditions  for  a fire  or 
explosion. 

4. 2. 1.3  Conclusions 

Evaluation  of  the  hazards  leads  to  the  following  safety  conclusions 
Involving  propellant  logistic  element  tank  loading  ground  operations: 

a.  A series  loading  concept  with  separation  of  facility  lines  and 
Interconnect  fixtures  presents  fewer  hazards  when  the  propellant 
logistic  element  In  the  cargo  bay  Is  loaded  by  a separate  propellant 
loading  system,  Independent  of  the  booster/orblter  propellant 
loading  system. 

b.  Although  one  line  Interconnect  fixture  containing  both  LO2  and  LH2 
lines,  pressurization,  etc.,  can  be  used  for  safe  operation  under 
orbital  ambient  vacuum  conditions,  the  use  of  this  fixture  under 
emergency  off  load  and  drain  requirements  for  ground  operation 
presents  potential  mixing  hazards.  This  condition  suggests  either 
a design  driver  for  preventing  any  leakage  at  the  Interconnect 
fixture,  or  separation  by  use  of  two  Interconnect  fixtures  each 
containing  only  one  line;  e.g.,  LO2  or  LH2.  An  assumption  In  this 
case  Is  that  In  an  emergency  the  off  load  would  be  accomplished  In 
parallel  through  the  separate  series  system. 

c.  The  Increased  rate  of  flow  for  serial  loading  of  propellants  to 
meet  the  two-hour  ground  loading  requirements  for  the  booster/ 
orblter  Increases  the  rate  of  flow  for  propellant  logistic  element 
propellant  loading  over  that  for  transfer  In  orbit,  which  will 
Increase  the  line  Interconnect  fixture  line  sizes  over  those 
necessary  for  orbital  propellant  transfer. 

This  Increase  In  flow  rate,  however,  does  not  materially  Increase 
Che  hazard  except  In  the  case  where  the  line  size  Is  small  enough 
to  Impact  the  capability  to  off  load  under  emergency  conditions. 
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This  consideration  from  a safety  position  Is  a driver  In  establish- 
ing line  sizes  for  Interconnect  fixtures  or  providing  separate  fill 
and  drain  system  lines. 

d.  Before  the  use  of  slush  hydrogen  is  programmed  In  an  operational 
concept,  additional  study  of  the  concept  design  configurations 
should  be  made. 

4.2.2  Launch  and  Ascent 

In  the  conceptual  system  the  status  of  the  cargo  bay  during  launch  and 
ascent  should  remain  essentially  the  same  as  Just  prior  to  launch,  except 
that  with  the  Increase  In  altitude  the  nitrogen  purge  will  vent  from  the 
cargo  bay  In  less  than  three  minutes  after  launch. 

This  will  not  materially  add  to  the  hazards  since  any  failure  within 
the  first  3 minutes  would  be  expected  to  be  of  major  proportions.  With 
attainment  of  higher  altitude  (approximately  180,000  feet  at  3 minutes)  the 
likelihood  of  fire  continually  decreases  due  to  ambient  vacuum  conditions. 

One  condition  however  does  present  a hazard  which.  If  not  properly  con- 
tained, would  produce  undeslred  conditions.  This  condition  Is  the  possibility 
of  the  propellant  tankage  vents  relieving  within  the  cargo  bay  (both  liquid 
oxygen  and  hydrogen  simultaneously)  causing  an  explosive  mixture  with  the 
cargo  bay  doors  shut.  This  problem  is  minimized  If  the  tank  vent  systems 
are  properly  designed  for  fluid  separation  and  containment  of  vented  fluids. 

After  post  Injection  maneuver  main  engine  cutoff,  the  cargo  bay  doors 
are  opened.  Failure  of  the  cargo  bay  doors  to  fully  open  or  close  could 
cause  delay  or  loss  of  mission.  Another  hazard  associated  with  partial  door 
opening  worthy  of  note  Is  the  adverse  effect  on  proper  operation  of  the  space 
radiators  located  in  the  doors  and  which  support  the  ECLSS.  Abort  considera- 
tions In  this  phase  are  discussed  in  Section  4.2.7. 

4.2.3  Orbital  Phase 

Operations  In  this  phase  Involve  transfer  of  propellants,  use  of  deploy- 
ment mechanisms  and  soft  docking  methods,  retrieval  of  down  modules,  securing 
elements  In  the  cargo  bay  and  maintenance  operations  using  IVA  and  EVA.  These 
operations  are  discussed  In  the  following  paragraphs. 

4. 2. 3.1  OMS  Propellant  Transfer 

The  OMS  tanks  In  the  shuttle  orbiter  may  contain  excess  propellants 
which  the  representative  propellant  logistics  elements  could  utilize.  These 
propellants  could  be  expected  to  be  transferred  on  the  Initial  flight  Into  the 
tug  or  centaur  prior  to  deployment  out  of  the  cargo  bay.  For  this  operation, 
lines  from  the  OMS  tanks  run  through  a series  of  valving  and  pumps  to  the  line 
Interconnect  fixture.  This  entire  operation  In  space  Is  relatively  safe 
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if  leakage  does  not  exceed  specification  requirements.  However,  large  mass 
spills  could  be  expected  to  produce  snow  or  Ice  crystals  which  could  cover 
the  cargo  bay  walls  and  propellant  tankage  or  propulsive  stage.  These  crystals 
could  be  expected  to  sublime  away  over  a period  of  time  (hours)  from  surfaces 
where  heat  transfer  will  occur.  However  those  portions  of  the  snow  or  Ice 

which  are  formed  in  the  Internal  cavities  of  the  orbiter  where  little  or  no 

heat  transfers  into  the  surfaces  could  present  a fire/ explosive  hazard  during 

re-entry.  Thus,  it  is  imperative  that  any  rapid  drop  in  line  pressure  which 

could  signify  massive  leakage  be  accompanied  with  a pump  and  system  cutoff 
device  Interlock.  See  Paragraph  4.2.6  for  sublimation  of  solidified  propel- 
lants. 

4 . 2 . 3 . 2 Deployment 

During  deployment  of  the  propellant  tankage  or  propulsive  stages  out  of 
the  cargo  bay,  various  hazards  are  postulated.  In  the  case  where  the  cargo 
bay  doors  are  not  fully  opened  to  provide  clearance  of  the  load,  any  attempt 
to  deploy  the  load  could  produce  Impact  damage  or  reduce  the  structural 
integrity  of  the  orbiter  cargo  bay  doors.  If  the  Impact  is  on  the  radiators 
of  the  ECLSS  located  in  the  cargo  bay  doors  additional  hazards  are  Involved. 
This  then  suggests  a safety  Interlock  between  the  cargo  bay  doors'  position 
and  the  deployment  mechanism  control  (manipulator  and  rotational  deployment 
mechanisms).  Due  consideration  must  be  made  in  the  Interlock  design  to  assure 
once  the  deployment  mechanisms  are  in  a position  to  preclude  the  cargo  bay 
doors  from  normal  closure  that  a failure  in  the  interlock  will  not  prevent 
the  deployment  mechanism  from  being  returned  into  the  cargo  bay  sufficiently 
to  allow  the  doors  to  be  closed.  Deployment  mechanisms  considered  in  cargo 
bay  operations  included  both  manipulators  and  rotational  devices.  The 
manipulator  concept  for  deploying  large  masses  in  orbit  has  little  state-of- 
the-art  to  draw  on  when  it  comes  to  booms  of  50  feet  or  more.  It  can  be 
postulated  that  a number  of  hazards  will  exist  during  deployment.  These 
generally  involve  the  location  of  attach  points  of  the  manipulator,  the 
ability  to  maintain  smooth  directional  control  and  rate  on  both  manipulator 
arms  during  module  extraction,  and  depth  perception  ability  without  some 
type  of  stereo  optics  support.  Hazards  are  also  associated  with  the  manipu- 
lators when  the  Joints  operate  erratically  and  where  the  system  falls  with 
the  manipulator  in  a position  which  precludes  cargo  bay  door  closing.  See 
evaluation  in  Section  6.0. 

In  the  many  cases,  the  introduction  of  the  hazard  mode  leads  to  Impact. 

See  Figure  4. 2. 3. 2-1. 

The  rotational  mechanism  for  deplo}rment  has  built-in  stability  through- 
out the  deployment  operation.  In  this  concept  there  is  a hazard  introduced 
if  the  module  attach  fittings  of  the  cargo  bay  do  not  properly  release  prior 
to  an  attempt  to  deploy  the  module  out  of  the  cargo  bay.  This  suggests  that 
an  Interlock  between  the  attach  fitting  release  mechanism  and  the  deployment 
mechanism  control  is  required  to  eliminate  possible  structural  damage/ failure. 
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Fi gure a . 2 . 3 . 2-1  Deployment  Concepts 
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4 . 2 . 3 . 3 Docking 

Propellant  logistic  element  direct  docking  Involves  the  approach  of  the 
two  docking  vehicles  so  that  the  Integrally  attached  docking  mechanisms  can 
make  contact  for  Initial  capture.  This  system  Is  characterized  by  the  use 
of  the  propulsive  capability  of  .one  of  the  mating  vehicles  to  effect  final 
closure  and  docking  contact  and  a relative  short  and  stiff  Impact  attenuation 
stroke  of  the  docking  system.  Typically,  this  stroke  Is  approximately  ten 
(10)  Inches  or  less.  This  direct  docking  characterizes  the  mode  used  where 
the  propellant  tankage  or  propulsive  stage  Is  rotated  out  of  the  cargo  bay. 

The  direct  docking  system  requires  the  dissipation  of  relatively  large  energy 
levels  because  of  the  coarse  velocity  control  expected  for  propulsive  maneu- 
vers and  the  movement  of  the  large  masses  Involved.  In  direct  docking,  one 
of  the  vehicles  Is  passive  and  stabilized  prior  to  the  docking  operation. 
Failure  to  Inhibit  attitude  hold  on  the  passive  vehicle  presents  the  hazard 
where  both  control  systems  (active  and  passive  vehicle)  are  attempting  to 
hold  their  respective  misaligned  attitudes  after  an  Initial  docking  attempt. 
This  could  cause  extensive  structural  damage  at  the  docking  Interface  and 
would  occur  during  the  period  when  the  two  masses  are  not  rlgldlzed  In  all 
degrees  of  freedom  of  motion.  Heavy  docking  Impact  coupled  with  fluid  motion 
could  cause  the  undeslred  motion  between  vehicles. 

Docking  of  propellant  logistic  elements  by  use  of  manipulators  con- 
trolled from  the  orblter  affords  a larger  standoff  distance  between  vehicles 
than  direct  docking.  In  using  the  manipulators  for  docking  the  propellant 
logistic  element  (propellant  tankage) , greater  flexibility  Is  provided  in 
alignment  and  docking  where  the  passive  target  Is  not  In  the  same  relative 
state  of  stabilization  as  the  active  vehicle.  Since  closing  velocities  will 
be  a function  of  the  operator's  control  capability,  manipulator  closing 
velocities  (0.1  ft/sec)  will  be  under  better  control  for  the  mass,  than  In 
direct  docking  with  contact  velocities  up  to  one  (1)  ft.  per  second.  The 
hazards  of  the  manipulator  concept  are  grossly  associated  with  Instability 
of  the  mass,  at  the  end  of  the  manipulator.  Fluid  sloshing,  RCS  operation, 
and  manipulator  dynamics  with  the  mass  attached  could  lead  to  Instability 
and/or  Impact.  See  Paragraph  4.2.8  for  propulsive  effect  of  venting  or 
leaking  fluids. 

Hangups  during  the  docking  process  where  a capture  latch  Is  holding 
the  docking  port  In  an  unrlgldlzed  mode  also  could  present  hazards  by 
Imparting  an  undeslred  rotation  to  the  passive  vehicle  which  could  not  be 
controlled  by  the  manipulator  control  operator.  The  magnitude  of  this  type 
of  hazard  Is  a function  of  the  maximum  offset  of  the  docking  port  from  the 
CG  of  the  entire  configuration,  and  control  operation  of  the  configuration 
Immediately  before  or  after  contact. 

4. 2. 3. 4 Module  Retrieval 

Module  retrieval  by  the  direct  docking  method  or  manipulator  concept 
Involves  the  same  general  type  of  hazards  as  those  during  module  docking. 
Direct  docking  for  module  retrieval,  by  the  orblter ^ would  place  the  retrieved 
module  on  the  docking  ring  of  the  cargo  bay  rotational  deployment  mechanism. 
Due  to  the  close  proximity  of  the  vehicles  and  large  energy  Involved  In  shock 
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attenuation,  the  hazards  appear  to  be  somewhat  greater  in  the  direct  docking 
method  than  those  In  the  use  of  manipulators,  although  control  of  the 
module  Into  the  cargo  bay  Is  estimated  to  be  much  more  stable  by  the  rotation- 
al deployment  mechanism.  Hazards  common  to  retrieval  by  either  concept  Involve 
Impact,  either  through  projections;  l.e.,  antenna  not  retracted,  loose  material 
In  the  cargo  bay,  etc.,  or  through  operator  error/faulty  equipment.  It  should 
be  noted  that  there  Is  no  uniform  attach  point  mechanism  between  modules  and 
the  orblter  cargo  bay,  and  where  random  module  retrieval  Is  fequlred  In  a 
logistics  system,  this  factor  can  become  a driver  In  configuration  Interface 
design,  between  the  elements  and  orblter,  for  the  line  Interconnect  fixture. 

A. 2. 3. 5 Cargo  Bay  Attachment 

System  Safety  can  be  achieved  or  negated  by  the  location  of  attach 
points.  They  will  have  to  Index  to  the  line  Interconnect  fixture  for  remote 
automatic  re-connect  of  lines  and  vents  In  the  cargo  bay,  for  off  loading 
residual  propellants,  pressurization,  etc.  This,  In  the  rotational  deploy- 
ment mechanism  concept,  could  be  accomplished  when  the  module  Is  Indexed  to 
the  mechanism  docking  ring.  With  the  use  of  manipulators  for  emplacement  of 
the  module  In  the  cargo  bay,  the  attach  points  will  have  to  provide  the 
Indexing  needed  for  line  Interconnect  fixture  mating  In  the  cargo  bay.  This 
also  Is  true  for  vent  line  re-connects  to  prevent  hazardous  vapor  venting  In 
the  cargo  bay.  See  Figure  4. 2. 3. 5-1  for  schematic  of  problem.  The  magnitude 
of  the  Interface  problem  Is  shown  In  Figure  4. 2. 3. 5-2. 

4 . 2 . 3 . 6 IVA  and  EVA  Maintenance 

Orbital  operations  Involving  man-ln-the-loop,  other  than  shuttle  orblter 
personnel,  are  associated  with  maintenance  or  bulld-up  requirements. 

In  a propellant  logistic  system  which  Is  remote,  fully  automatic,  and  contains 
ground  control  override  capability,  maintenance  will  be  required  for  failed 
components,  routine  maintenance  Items,  and  damage  caused  by  Impact.  Also 

Included  will  be  Items  with  reduced/deteriorating  performance* In 

those  cases  other  than  a large  depot,  maintenance  could  be  accomplished  by 
return  of  the  element  to  earth.  Where  the  return  to  earth  Is  Impractical  or 
Impossible  the  use  of  a crew  and  or  equipment  module  Is  required  for  transfer 
of  crew  and  equipment. 

System  Safety  requirements  dictate  that  these  modules  be  unmanned  during 
their  docking  between  the  orblter  and  logistic  element  scheduled  for  mainten- 
ance. Personnel  would  then  transfer  through  the  shuttle  hatch  Into  the 
module.  These  transfers  will  be  IVA  and  the  suited  maintenance  personnel 
must  bring  the  life  support  environment  In  the  LSF  up  to  the  required 
level  or  remain  suited  during  the  maintenance  operation.  The  orblter  would 
remain  attached  for  any  evacuation  needed  during  the  maintenance  process. 

At  least  two  paths  must  be  available  for  emergency  evacuation  or  protection 
of  the  crews.  Figure  4. 2. 3. 6-1  schematically  portrays  the  modules  which  pro- 
vide two  paths  of  escape  for  maintenance  crews  during  IVA. 

For  the  Orblter  Model  176A  the  location  of  the  shuttle  docking  port 
would  be  changed  to  a forward  upper  location  of  the  fuselage; -however , the 
processes  would  remain  the  same.  For  the  EVA  operations  on  distant  equipment 
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such  as  the  antenna  or  RCS  packages,  the  orblter  vehicle  may  be  used  for  this 
operation  with  a suitable  stand-off  distance  from  the  maintenance  location. 

For  this  operation  two  or  more  EVA-sulted  maintenance  personnel  should  be 
working  together  with  an  additional  EVA-sulted  crew  member  standing  by  to 
effect  rescue  operations.  His  standby  position  would  be  In  the  orblter 
docking  air  lock  at  a vantage  point  where  he  can  observe  all  operations. 

His  location  must  be  provided  with  a communication  capability  to  direct 
the  orblter  Into  a position  for  Immediate  rescue. 

4. 2. 3. 7 Conclusions 

Evaluation  of  the  orbital  operations  leads  to  the  following  safety 
conclusions: 

1.  Where  leakage  has  occurred  within  the  cargo  bay.  It  must  be 
detected  by  some  means  and  be  sublimed  away  before  re-entry  Is 
attempted. 

2.  Impact  damage  during  deployment  and  retrieval  Is  a major  considera- 
tion, the  hazards  of  which  produce  latent  flre/exploslon  conditions. 

3.  Both  rotational  and  manipulator  deployment  mechanisms  have 
advantages  which  are  related  to  the  total  operation,  each  being 
best  for  a particular  operation.  See  Section  6.0  for  comparison 
of  rotational  vs.  manipulators. 

4.  The  relation  of  the  attach  points  to  the  Indexing  of  the  mating 
line  Interconnect  fixtures  Is  critical. 

5.  Maintenance  operations  Involving  man-in-the-loop  should  be 
by  IVA.  EVA  operations  should  be  a "last  resort"  under  any 
condition. 

4.2.4  Deorblt  Phase 

This  phase  Involves  those  operations  in  orbit  to  prepare  the  retrieved 
module  for  Its  return  to  earth.  This  will  encompass  not  only  the  afore- 
mentioned securing  and  connect  problems  but  also  verification  of  the  Integrity 
of  the  module  to  retain  pressures  at  14.7  psl  with  no  out  of  specification 
leakage.  Once  the  returning  module  has  been  secured  at  the  attach  points 
and  the  line  Interconnect  fixtures  mated,  the  pressurization  and  leak  check 
Is  accomplished.  See  Hazard  //75  In  Appendix  C.  Floodlights  and  TV  aids  are 
used  for  all  operations.  Failure  of  these  aids  reduces  the  data  for  decision 
making  and  could  lead  to  Incorrect  decisions,  creating  a hazard.  This  could 
be  postulated  In  the  case  where  a pressure  decay  In  the  propellant  tank 
module  was  noted  when  the  tank  contained  residual  propellants.  Quantities 
and  location  of  leaking  propellant  could  not  be  observed  with  the  aids 
failed  and  thus  could  affect  the  orbital  stay  decision  to  allow  time  for 
fluid  sublimation,  and  the  decision  to  remove  the  module  from  the  cargo 
bay  to  determine  the  .leaking  condition,  etc..  These  hazards  are  to  be  considered 
latent  in  their  onset  and  would  be  expected  to  become  effective  In  the  deorblt 
phase,  causing  potential  fire  or  explosion.  The  risk  potential  of  hydrogen 
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leaking  in  the  orbiter  cargo  bay  is  presented  in  paragraph  4.2.5. 


4.2.5  Hydrogen  Leakage  into  Orbiter  Cargo  Bay 

Because  of  the  leakage  hazards  identified  in  the  analyses  which  could 
occur  within,  or  affect  the  cargo  bay  area,  a separate  assessment  was  made 
to  develop  a technique  for  establishing  the  risk  potential  of  hydrogen  leak- 
ing into  the  orbiter  cargo  bay  from  a propellant  tank  module  carried  as 
cargo . 

4 . 2 . 5 . 1 Re-Entry  Case 


a.  Groundrules 

If  a typical  example  of  a shuttle  cargo  such  as  the  tug  is  chosen 
for  analysis  the  following  groundrules  can  be  established: 

1.  4%  by  volume  of  hydrogen  is  the  minimum  percentage  necessary 
to  support  a combustlve  or  explosive  reaction  (Reference  21) . 

2.  Hydrogen-oxygen  reactions  can  occur  at  pressures  equal  to  or 
greater  than  2 mm  Hg  (Reference  17). 

3.  No  liquid  hydrogen  remains  in  the  tug  hydrogen  tank 
(Reference  13A) . 

4.  Atmospheric  oxygen  is  available  for  reaction. 

5.  Every  source  that  can  leak  hydrogen  is  leaking  at  its 
allowable  rate.  These  leaks  are  distributed  through 
the  entire  length  of  the  tug,  and  the  leaking  gas  mixes 
intimately  in  the  volume  available  to  it  through  molecular 
diffusion. 

6.  Any  hydrogen  - oxygen  reaction  is  undesirable.  The  energy 
release  is  dependent  on  the  mass  of  reacting  hydrogen. 

b.  Determination  of  Leakage  Rate 

A typical  tug  schematic  was  examined  and  a total  of  233  possible 
leak  points  were  counted  that  could  be  exposed  to  hydrogen  under 
pressure.  These  leak  points  include  two  20"  diameter  manhole 
covers.  Many  of  these  leak  points  will  be  welded  joints  and 
flared  fittings  for  which  the  allowable  leakage  is  5.3  X 10~^ 
scc/sec  (Reference  MA0206-1258) . If  the  worst  case  is  assumed 
and  it  is  assumed  that  all  the  leak  points  are  flanged  fittings 
2-1/2"  diameter,  the  allowable  leakage  is  0.01  scc/sec/lnch  of 
seal  (see  - standard  cubic  centimeters)  (Reference  MA0206-1255) . 
At  this  leakage  rate^  from  233  flanged  fittings^  a volume  of  6.07 
scf/day  or  approximately  1/4  scfh  (standard  cubic  feet  per  hour) 
will  leak  from  the  tug. 
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c.  Determination  of  Reaction  Volume  of  Leaking  Hydrogen 

If  the  tug  is  emplaced  In  the  cargo  bay  and  the  doors  are  closed  In 
preparation  for  re-entry  the  volume  available  for  reaction  is  the 
net  volume  of  the  cargo  bay  minus  the  cargo  volume.  See  Figure 
4. 2. 5. 1-1  and  4. 2. 5. 1-2.  The  cargo  bay  volume  is  19,400  cubic  feet 
(Reference  59)  and  the  tug  volume  can  be  calculated  as  approximately 
2700  cubic  feet  and  the  volume  available  for  reaction,  the  free 
volume.  Is  16,700  cubic  feet.  Of  course,  larger  cargoes  or  payloads 
on  the  tug  would  reduce  the  free  volume,  but  not  enough  to  alter  the 
conclusions  (see  the  two  points  plotted  on  Figure  4. 2. 5. 1-3). 


I NSULATJON  PURGE  BAG  VENT 
AMBIENT  PRESSURE  VENTS 
LEAKAGE  POINTS 


PROPELLANT  TANK  VENTS 
PROPELLANT  FILL  AND  DRAIN/DUMP 
CARGO  DOORS  OPEN  IN  ORBIT 

SHUTTLE  CARGO  BAY  (REF)- 


FREE  CARGO  BAY  VOLUME 


GROUND  GN2  BAY  PURGE 


Figure  4. 2. 5. 1-1  Tug  Emplaced  In  Shuttle  Cargo  Bay 


Flgur.e  4.2. 5.1-2  Typical  Shuttle  Cargo  Bay  Cross  Section  with  Cargo  In  Place 


- 68  - 


SD72-SA-0054-3 


ACCUMULATED  LEAICAGE  OF  H2  (SCF) 


Space  Division 

North  American  Rockwell 


Figure  4.2.5J-3  H2  Leakage  In  Cargo  Bey  on  Re>entry 


d.  Determination  of  Hazardous  Concentrations 

During  re-entry  preparations,  utilizing  the  current  sequence  of 
events,  the  tug  will  be  emplaced  In  the  cargo  bay,  the  residual 
liquid  hydrogen  will  be  dumped  and  the  tank  vented  to  vacuum  and 
re-pressurized  to  17  psla  (one  or  more  times) . At  this  time  the 
shuttle  will  begin  its  re-entry  flight.  The  tug  will  continue  to 
leak  hydrogen  gas  from  the  possible  leak  points  and  this  hydrogen 
will  accumulate  in  the  free  volume  when  external  pressure  is  greater 
than  cargo  bay  pressure. 

Using  Internal  cargo  bay  pressure  4. 2. 5. 1-4  (Reference  59)  the 
leaking  hydrogen  that . is  expressed  as  standard  cubic  feet  will  expand 
to  fill  a larger  volume.  Since  computer  programs  have  not  been 
developed  to  permit  predictions  of  how  much  of  the  leaking  hydrogen 
would  diffuse  out  of  the  cargo  bay  the  worst  case  was  assumed.  If 
all  the  leaking  hydrogen  remained  in  the  cargo  bay  from  time  zero 
(closing  cargo  bay  doors)  until  cargo  bay  pressure  becomes  great 
enough  to  permit  reactions  the  leaking  hydrogen  will  expand  inverse- 
ly as  the  cargo  bay  pressure.  Several  points  on  the  curve  in 
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Figure  4. 2. 5. 1-4  were  chosen  to  Investigate  the  Influence  of  cargo 
bay  pressure  and  it  was  found  that  a constant  hydrogen  leakage 
would  expand  to  maximum  concentration  at  2 mm  Hg,  where  reactions 
are  first  possible.  As  a consequence  the  single  most  hazardous 
time  in  the  re-entry  flight  profile  is  that  time  at  which  cargo 
bay  pressure  reaches  2 mm  Hg,  and  less  hazardous  before  and  after 
that  time,  as  far  as  leakage  is  concerned. 

Using  simple  pressure-volume  relations,  with  constant  temperature, 
the  leaking  hydrogen  will  expand  760/2  or  380  times.  The  above 
leakage  then  expands  to  380  times  0.25  or  95  cfh.  From  Figure 
4. 2. 5. 1-4  the  orblter  pressure  reaches  2 mm  Hg  in  2400  seconds  or 
2400/3600  hours,  or  a total  leakage  volume  of  63  cu.  ft.  63/16700 
gives  a concentration  of  0.0038  or  0.38%  which  is  less  than  1/10 
of  the  hazardous  concentration. 


FUGHT  TIME  (SECONDS) 

Figure  4. 2. 5. 1-4  Cargo  Bay  Internal  Pressure  Time  History  During  Re-Entry 
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As  more  precise  Information  becomes  available  on  (1)  the  free  cargo 
bay  volume,  (2)  the  exact  configuration  of  the  cargo  and  Its  leak- 
age, and  (3)  better  methods  to  determine  how  much  hydrogen  remains 
in  the  cargo  bay,  the  curve  shown  in  Figure  4. 2. 5. 1-3  would  be 
useful.  This  curve  relates  the  total  accumulated  leakage  to  the 
free  volume  to  arrive  at  a 4%  hydrogen  curve.  The  area  above  the 
curve  would  have  greater  than  4%  H2  and  be  hazardous  and  the  area 
below  would  contain  less  than  4%  and  be  safe. 

4. 2. 5. 2 Technical  Discussion  - Percentage  Hydrogen  in  Hydrogen  Tank 
Pressurant 

The  foregoing  discussion  addressed  Itself  to  leaking  hydrogen  gas 

from  many  sources.  . This  aas  leaking  at  the  "normal"  rate  (that 
rate  allowed  by  specification)  could  be  lOOZ  hydrogen  and  not  reach 
hazardous  concentrations. 

If  a failure  Is  assumed  on  the  tug  when  In  the  cargo  bay  after  the 
shuttle  has  committed  to  re-enter  and  a "blowing"  leak  develops  the  leakage 
assumes  a different  character.  Any  leak  from  a point  source  will  release 
the  gas  In  Jet  form.  See  Figure  4. 2. 5. 2-1.  This  jet  will  Interface  with 
the  atmosphere  and  at  some  point  along  this  Interface  a reaction  can  occur 
If  the  percentage  of  hydrogen  In  the  interface  is  4%  or  greater.  Reference 
11  pointed  out  that  hydrogen-oxygen  reactions  could  occur  when  the  percentage 
of  oxygen  In  the  mixed  gases  was  2%  or  greater. 


Figure  4. 2. 5. 2-1  A Blowing  Leak  of  LH2  Into  Cargo  Bay 
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Since  the  oxygen  source  In  the  cargo  bay  will  be  the  atmosphere  and 
since  air  is  approximately  20%  or  1/5  oxygen  the  Interface  mixture  must  con- 
tain a minimum  of  2%/l/5  or  10%  air  to  provide  enough  oxygen  to  support  a 
reaction.  As  a result  90%  of  the  gas  in  the  jet  must  contain  enough  hydrogen 
to  bring  the  concentration  of  hydrogen  to  4%  in  the  Interface  mixture  to  per- 
mit a reaction.  Therefore,  the  maximum  allowable  concentration  of  hydrogen 
in  a blowing  leak  is  4%/90%  or  4.5%.  The  gases  escaping  from  a blowing  leak 
will  be  diluted  by  the  entrained  air  that  provides  the  oxygen  for  a reaction 
and  these  gases  must  contain  more  than  4%  hydrogen  (see  Figure  4. 2. 5. 2-1). 

Since  the  leakage  to  be  expected  from  components  that  are  operating 
within  specification  is  not  hazardous,  blowing  leaks  that  are  hazardous 
would  be  caused  by  a failure.  If  it  is  decided  to  protect  the  shuttle  against 
these  failures  by  inerting  the  hydrogen  tank  the  hydrogen  concentration  must 
be  ^4.5%. 


4. 2. 5. 3 Technical  Discussion  - Detection  of  Blowing  Leaks 

As  shomi  in  the  discussion  of  the  percentage  hydrogen  allowable  in  the 
gases  leaking  from  the  hydrogen  tank,  blowing  leaks  could  be  hazardous  to 
the  shuttle  and  crew.  It  is  evident  that  a means  must  be  devised  to  detect 
the  presence  of  blowing  leaks. 

In  most  cases  the  returning  element  will  have  completed  its  mission, 
the  propellants  will  be  largely  depleted,  the  pressure  in  gas  containers  will 
have  been  greatly  reduced  and  flight  stress  Imposed  by  thrust  and  maneuvers 
will  be  absent.  Its  Job  is  done  and  the  evaluation  of  that  job  as  well  as 
the  examination  of  the  physical  condition  of  the  element  prior  to  placing 
it  in  the  cargo  bay  will  determine  whether  it  has  been,  or  is  leaking. 

Engine  performance  data,  propellant  and  pressurant  utilization  data 
will  assist  in  determining  whether  gross  leakage  was  present  during  previous 
operations  of  the  element.  As  the  temperature  stabilizes  and  the  element 
warms  up  to  reach  steady  state  conditions  the  likelihood  of  leakage  decreases. 

The  second  and  probably  the  most  important  leak  check  that  can  be  made 
prior  to  placing  the  element  in  the  cargo  bay  is  a visual  check  of  the  hydro- 
gen systems.  As  demonstrated  on  Apollo  9,  blowing  leaks  are  highly  visible. 
On  this  flight  the  S-IVB  performed  a second,  unscheduled,  vent  of  the  propel- 
lant tank  when  it  was  approximately  100,000  km  from  the  earth,  on  its  way  to 
the  sun  (Reference  2A) . This  vent  was  observed  and  photographed  from  the 
earth  as  shown  on  Apollo  9.  Any  blowing  leak  would  rapidly  condense  the 
leaking  fluids  into  clouds  of  "ice"  crystals  that  would  be  readily  visible 
during  a pre-emplacement  visual  examination  that  should  be  conducted  of  the 
returning  element . 

During  rendezvous , docking  and  emplacement  of  the  element  into  the  cargo 
bay  the  element  will  be  under  the  visual  control  of  the  orblter  crew.  If 
the  element  has  been  damaged  such  that  it  would  leak,  the  crew  will  know  it 
and  should  defer  the  deorbit  of  the  element. 
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After  the  element  is  in  place  in  the  cargo  bay  and  the  element/orblter 
Interface  connection  has  been  made  the  third  type  of  leak  check  should  be 
made.  The  critical  Interface  connection  must  be  verified  to  be  leak  free. 

A commonly  used  technique  Is  to  run  a pressure  decay  check.  The  interface 
connection  Is  Isolated,  pressurized  and  the  pressure  monitored.  If  the 
pressure  decays  the  Interface  Is  leaking.  If  the  leakage  exceeds  the 
allowable  rate  corrective  action  must  be  taken  prior  to  committing  to  re- 
enter to  prevent  hydrogen  leakage  Into  the  cargo  bay. 

After  the  Interface  has  been  determined  to  be  leak-free  the  propellants 
should  be  dumped  If  this  operation  has  not  been  performed  outside  the  cargo 
bay.  The  objective  of  the  propellant  dump  would  be  to  eliminate  as  much  of 
the  residual  liquid  propellants  as  possible. 

After  propellant  dump  other  pressure  decay  tests  can  be  run  to  pick  up 
gross  leakage.  In  the  case  of  the  point-design  tug,  the  hydrogen  tank 
contains  1904  cu.  ft.  Assume  that  a decay  test  has  been  performed  and  that 
the  pressure  had  decayed  from  17  psla  to  16.9  psla  (such  a pressure  differ- 
ential is  well  within  the  state-of-the-art).  Using  simple  PV  relationships 
and  constant  temperature: 

Pi  Vi  = P2  V2 

17  X 1904  = 16.9  X V2  = 1915 

Since  V2  “ 1915,  1915-1904  - 11  cu.  ft.  of  gas  at  17  psla  would  have 

leaked  out,  or: 

11  X 17  = 12.7  scf  of  leaking  gas 

14.7 

If  It  Is  further  assumed  that  the  period  over  which  this  leakage 
occurred  was  the  same  as  the  time  required  to  reach  the  altitude  where  the 
cargo  bay  pressure  Is  2 mm  Hg,  then  Figure  4. 2. 5. 1-3  can  be  used  to  deter- 
mine the  permissible  hydrogen  concentration  In  the  leaking  gas . From 
Figure  4. 2. 5. 1-3  it  can  be  seen  that  approximately  1.75  scf  of  hydrogen 
will  produce  a 4%  of  hazardous  concentration  In  the  cargo  bay  with  the  tug 
In  place.  Then  the  allowable  percentage  of  hydrogen  In  the  tug  tank  Is: 

1.75  - .138  - 13.8% 

12.7 

Or,  stated  another  way.  If  a pressure  decay  test  shows  that  the  hydrogen 
tank  decays  0.1  psla  In  40  minutes  or  less  and  the  percentage  of  hydrogen 
In  the  tank  Is  13.8%  or  more  the  orblter  and  crew  would  be  exposed  to  fire 
and  explosion  hazards  on  re-entry. 

The  above  example  assumed  that  the  temperature  was  constant.  If  the 
temperature  varies,  PV/T  relationships  could  be  used  In  the  decay  test.  It 
Is  doubtful  that  a valid  decay  test  could  be  run  If  any  liquid  hydrogen 
remained  In  the  hydrogen  tank,  since  the  liquid  would  tend  to  vary  the  tank 
pressure. 
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4. 2. 5. A Hydrogen  Leakage  Into  Orblter  Cargo  Bay  - Conclusions 

Several  conclusions  can  be  drawn  from  this  analysis  of  hydrogen  leakage 
into  the  cargo  bay  of  the  shuttle  on  re-entry.  They  are  re-stated  here  in 
summary : 

a.  Liquid  propellants  should  be  dumped  from  propellant  logistics 
elements  prior  to  re-entry. 

b.  Propellant  logistics  elements  should  be  visually  checked  for 
leakage  prior  to  emplacement  in  the  shuttle  cargo  bay. 

c.  Normal  leakage  within  specification  limits  is  safe  for  re-entry, 
for  any  concentration  of  hydrogen  in  the  leaking  gases. 

d.  Blowing  leaks  into  the  cargo  bay  are  hazardous,  if  the  concentration 
of  hydrogen  in  the  leaking  gases  is  ^4.5%. 

e.  Blowing  leaks  are  detectlble  by  existing  procedures. 

f . The  free  volume  of  the  cargo  bay  should  be  made  as  large  as 
structural  requirements  permit  by  the  elimination  of  unnecessary 
compartmentation . 

g.  The  shuttle  orbiter  should  be  provided  with  a closed  vent  and/or 
dump  system  that  will  make  a leak-tight  Interface  with  the  propel- 
lant logistics  element  and  terminate  in  the  ambient  atmosphere. 
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4.2.6  Sublimation  of  Solidified  Propellants 

During  the  System  Safety  analysis  the  hazard  was  Identified  of  solidified 
propellants  Impinging  upon  cargo  bay  surfaces  and  remaining  there  to  cause 
fire/explosion  during  re-entry.  The  preventive  measures  that  were  developed 
Included  the  requirement  to  visually  Inspect  the  Interior  surfaces  of  the 
cargo  bay  prior  to  emplacing  a returning  module.  When  solidified  propellants 
were  found  a further  restriction  was  placed  on  the  orblter  to  defer  re- 
entry until  the  solidified  propellants  had  sublimed. 

Further  analysis  was  conducted  to  determine  the  length  of  time  that 
might  be  required  for  this  sublimation.  Reference  2A  has  projected  estimates 
for  the  lifetime  of  Individual  "Ice"  particles  in  free  space  that  would  not 
be  directly  applicable  to  the  case  under  consideration.  Individual  "Ice" 
particles  could  accumulate  In  loose  form,  similar  to  a snow  bank  on  cargo 
bay  doors,  walls  and  floor.  The  amount  of  this  accumulation  would  be  depen- 
dent on  the  proximity  and  severity  of  the  leak  as  related  to  the  cargo  bay 
surfaces.  One  of  the  primary  means  that  could  be  used  to  dissipate  this 
"Ice"  would  be  to  add  heat.  Since  the  cargo  bay  doors  have  the  radiators 
attached  that  are  used  to  dissipate  the  heat  generated  within  the  sources, 
the  doors  will  be  warmer  and  not  be  governing  for  "Ice"  sublimation. 

Another  likely  source  of  heat  that  could  be  used  to  sublime  the  "Ice" 
would  be  the  solar  thermal  flux.  If  the  shuttle  was  oriented  toward  the 
sun  with  the  cargo  bay  doors  open  and  the  only  heat  source  considered  being 
the  solar  flux,  442.4  btu  per  hour,  will  fall  on  each  square  foot  of  the 
cargo  bay-  (Reference  8A) . If  the  solar  heat  flux  is  considered  to  be  ab- 
sorbed and  re-radlated  within  the  cargo  bay  then  this  heat  would  sublime  any 
"ice"  present  within  the  cargo  bay.  The  heat  of  vaporization  of  solidified 
H2  is  239.6  btu/lb.  (Reference  21)  and  442.4/239.6  - 1.85#  of  hydrogen 
would  be  sublimed  from  each  square  foot  of  cargo  bay  plan  area  or  approxi- 
mately 15  X 60  X 1.85  = 1660///hr  from  the  whole  cargo  bay. 

The  maximum,  practical,  amount  of  liquid  hydrogen  that  can  be  carried 
on  one  shuttle  flight  Is  28,500  lbs.  In  a module  designed  to  carry  LH2  only. 

To  choose  a worst  case  example,  assume  that  such  a module  Is  being  deployed 
from  the  cargo  bay  and  the  hydrogen  tank  ruptures  a weld  when  1/2  tank 
diameter  from  the  cargo  bay.  See  Figure  4. 2.6-1.  The  liquid  will  expand, 
characteristically,  180  degrees  and  quickly  freeze  Into  solid  particles. 
Approximately '15%  of  the  liquid  will  vaporize  to  solidify  the  remaining  85% 
(Reference  12).  Graphically,  It  can  be  determined  that  the  Included  angle 
through  which,  solid  particles  could  re-enter  the  cargo. bay  is  approximately  50* 


Therefore: 

50  X 28,500  lb.  x .85  “ 6730  lb.  of  solidified  hydrogen  Is  the  maximum 
180  . 

amount,  under  worst  case  conditions,  that  could  be  deposited  In  the  cargo 
bay.  In  actual  practice.  If  such  an  incident  did  occur  and  a hydrogen  tank 
dumped  its  whole  load  Into  the  cargo  bay  much  of  It  would  blow  out  because 
of  the  velocity  of  the  expanding  gaseous  hydrogen. 


- 75  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


If  It  Is  assumed  that  50%  of  the  solids  formed  remained  In  the  cargo 

bay, 


6730  X .50  «■  2 hours  = sublimation  time 
1660 

Under  worst  case  conditions  the  orblter  would  have  to  be  oriented  toward  the 
sun  for  at  least  two  hours  to  sublime  solidified  hydrogen. 


Figure  4.2.6>1  Solidified  Propellants  In  the  Cargo  Bay 
4.2.7  Abort  Considerations 

Any  discussion  of  the  requirements  Imposed  on  a propellant  logistics 
element  during  abort  conditions  must  begin  with  the  shuttle.  During  the  SD 
shuttle  studies  the  conditions  that  exist  during  abort  have  been  studied  for 
each  configuration  of  orblter  and  booster.  The  time  available  to  perform 
critical  functions  during  abort  Is  determined  by  several  factors.  These 
factors  Include  the  configuration  of  the  booster,  orblter  and  orblter  payload 
and  the  mission  requirements  Including  orbital  Inclination.  As  a result  of 
the  larg'e  himbef~  or  possible  combinations,  the  available  time  cannot  be  fixed 
but  presented  as  maximum  and  minimum. 

4. 2. 7.1  Landing  Safety  Relative  to  Payload  Weight 

In  general,  the  orblter  Is  restricted  to  landing  with  a 40,000-pound 
payload  with  an  optimum  degree  of  safety  and  with  larger  payloads  with  a 
reduced  factor  of  safety.  As  a result  any  propellant  logistics  element  must 
be  limited  to  a landing  weight  of  40K  to  Introduce  minimum  risk  to  the 
orblter  and  crew. 
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U.2.1.1  Shuttle  Abort  Regimes 

The  above-mentioned  combinations  can  be  divided  into  four  shuttle  abort 
regimes.  The  first  would  occur  from  liftoff  (T-0)  until  20-30  seconds 
after  liftoff  when  the  booster  has  not  imparted  sufficient  velocity  to  the 
orbiter  to  permit  Independent  orbiter  flight.  During  this  period  the  orbiter 
will  achieve  Independent  flight  capability  with  thrust  augmentation  by  add-on 
capability  such  as  solid  rocket  motors.  The  second  orbiter  abort  regime 
occurs  after  the  first  and  before  booster-orbiter  staging  when  the  orbiter 
has  Independent  flight  capability  and  elects  to  land  at  the  launch  pad.  The 
third  regime  is  the  same  as  the  second  with  the  landing  site  being  an 
alternate.  The  first  three  orbiter  abort  regimes  can  be  discussed  as  a 
single  abort  mode  for  a propellant  logistics  element  carried  as  cargo.  The 
period  during  the  200  to  300-second  orbiter  flight  to  the  landing  site  is 
the  time  that  must  be  utilized  to  dump  propellants,  as  necessary,  to  lighten 
the  orbiter  payload  to  meet  the  40K  landing  limitation.  Because  of  certain 
near-vertical  orbiter  flight  attitudes  and  propellants  lingering  near  the 
orbiter  it  would  not  be  advisable  to  dump  both  LOX  and  LH2  simultaneously. 

The  accelerated  combustion  of  the  hydrogen  in  this  case  could  be  hazardous 
to  the  orbiter.  The  two  abort  modes  are  summarized  in  Figure  4. 2. 7. 2-1. 

4. 2. 7. 3 Payload  Propellants  Dump 

If  the  propellant  logistics  element  in  the  orbiter  cargo  bay  contained 
both  LOX  and  LH2  (such  as  a tug  or  Centaur)  or  contained  LOX  only  (such  as 
a LOX  module) , the  least  hazardous  propellant  dumping  mode  would  be  to  dump 
the  LOX.  Because  of  the  greater  density  of  LOX  over  LH2  fewer  cubic  feet 
of  LOX  would  have  to  be  dumped  to  achieve  the  required  weight  reduction.  As 
a result  the  dump  line  would  be  smaller  and  lighter. 

When  the  propellant  logistics  element  in  the  cargo  bay,  external 
to  the  cargo  bay,  contains  LH2  only,  the  requirement  to  lighten  the  orbiter 
payload  would  become  the  driver  in  establishing  the  orbiter  flight  profile 
and  attitude.  When  dumping  LH2  in  the  atmosphere,  the  objective  should  be 
to  expose  the  orbiter  and  crew  to  the  minimum  risk  from  the  trailing  cloud  of 
hydrogen.  The  lines  would  have  to  be  sized  to  permit  dumping  the  necessary 
amount  of  LH2,  in  the  time  (200  seconds,  worst  case)  and  under  orbiter  flight 
attitudes  optimum  to  dumping  LH2.  Design  attention  must  be  given  to  the 
dump  line  exits,  its  placement  on  the  orbiter,  and  the  need  for  the  isolation 
of  atmosphere  and  hydrogen  to  prevent  the  back  diffusion  of  oxygen  into  the 
LH2  dump  line. 

After  staging  the  orbiter  has  once-around  abort  capability,  even  though 
a failure  would  prohibit  the  vehicle  from  achieving  final  orbit.  The  orbiter 
flight  time  during  this  fourth  abort  regime  is  approximately  100  minutes 
which  would  provide  adequate  time  to  dump  propellants  and  prepare  the  propel- 
lant logistic  element  for  a landing. 
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4.2.8  Propulsive  Effect  of  Venting  or  Leaking  Fluids 

The  propulsive  effect  of  vented  or  exhausted  fluids  from 
propellant  logistics  elements,  or  the  propulsive  effect  of  credible  leaks 
is  one  of  the  factors  that  must  be  considered  in  designing  the  stabilization 
systems  of  the  element. 

The  design  process  must  Include  the  sizing  and  placement  of  vents  and 
exhaust  outlets  and  the  trade-offs  must  be  performed  necessary  to  establish 
whether  the  outlets  are  to  be  propulsive,  nbn-propulslve  or  both  (on  command). 
Si^ce  the  elements  that  would  contribute  to  this  decision-making  process  are 
established,  they  will  not  be  addressed  here. 

The  assumptions  that  must  be  made  to  establish  the  propulsive  effect  of 
credible  leaks  would  Include  the  size  or  magnitude  of  the  leak  Involved.  One 
possible  source  of  sudden  leaks  would  be  holes  caused  by  the  ^pact  of  hyper- 
velocity  meteorites.  It~  has  become  a practice  to  lise  the  impact  of  a meteor- 
oid of  one  gram  mass  as  a design  point.  The  Impact  of  a meteoroid  of  this 
"size  would  produce  a hole  of  approximately  2"  diameter  in  typical  tank  walls 
and  this  can  be  used  as  the  size  of  credible  leaks. 

After  simplifying  assumptions,  the  following  approximates  the  thrust 
from  leaking  fluids. 

F “ PA,  for  gases 
F ■ 2 PA,  for  liquids 

where  F ■■  thrust  in  pounds 

P pressure  in  psia,  assume  32  psla 
A ■■  area  of  hole 

therefore:  F *■  32.2^  v = 100  lb.  for  gases 

4 

■ 2x32,22  s!  200  lb.  for  liquids 
4 

As  shown,  the  propulsive  effect  of  leaking  gases  can  be  a significant  factor 
in  its  contribution  to  the  vehicle  dynamics.  When  this  force  is  applied 
through  the  center  of  gravity  its  effect  is  simple  translation  of  the  leaking 
assembly.  This  would  be  a consideration  in  the  Impact  of  two  adjacent  vehicles 
when  the  force  is  not  directed  through  the  CG,  but  at  considerable  distance 
from  the  CG,  the  effect  will  be  to  Induce  rotation  of  the  assembly.  This 
rotation  could  have  adverse  effect  in  impacting  vehicles  that  are  close 
together  or  in  accelerating  or  decelerating  rotation. 

4.3  DESIGN  INFLUENCES  OF  HAZARD  ANALYSIS 

The  System  Safety  study  has  identified  hazards  within  the  representative 
orbital  propellant  logistic  operations  which  may  have  an  influence  on  the 
design  of  space  logistic  systems.  These  are  identified  in  the  following 
paragraphs . 
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4.3.1  Attach  Points  in  the  Cargo  Bay 

The  use  of  line  Interconnect  fixtures  for  line  connection  Interfaces 
with  the  cargo  bay  will  most  likely  be  located  at  a fixed  station.  During 
the  design  concept  phase,  the  number  of  logistics  elements  to  be  connected  at 
this  interface  should  be  considered  for  location  of  the  airborne  half  of  the 
line  Interconnect  fixture.  These  fixtures  will  be  indexed  by  the 
location  of  the  attach  points  on  the  orbiter  and  logistic  element.  Safety 
during  retrieval  operations  requires  attach  points  to  be  such  as  to  assure 
the  fixtures  can  be  mated  upon  return  of  the  logistic  element  into  the  cargo 
bay.  This  problem  is  accentuated  by  the  different  module  and  logistic 
element  lengths,  CG  location  and  location  of  anticipated  payloads. 

4.3.2  Capability  to  Determine  Residual  Propellants  Quantity 

The  capability  to  know  what  quantity  of  residual  propellants  are  in  the 
logistic  elements'  tanks  is  required  to  ascertain  that  it  is  safe  to  return 
to  earth  in  the  cargo  bay  of  the  orbiter.  The  logistic  element  will  be 
returned  to  the  cargo  bay  and  all  vents  will  be  connected  to  a vent  system, 
venting  overboard  from  the  orbiter.  The  propellants  within  the  logistic 
elements'  tanks  must  be  dumped  overboard  and  the  tanks  checked  for  leakage 
within  specification  after  dumping  excess  propellants.  The  residual  propel- 
lants could  be  the  source  for  tank  overpressurization;  if  due  to  insulation 
failure,  heat  is  transferred  into  the  tank  structure.  With  sloshing  of  the 
propellants,  the  propellants  will  instantly  gas  off  causing  increase  in 
ullage  pressure.  Should  excessive  amounts  of  residuals  remain,  gassing  off 
in  this  manner,  the  vent  valve  may  not  be  able  to  react  to  the  pressure 
buildup,  causing  tank  rupture.  Thus,  only  a quantity  of  residuals  which 
will  not  overpressurize  the  tank  under  re-entry  conditions  described  above 
will  be  allowed  to  remain  in  the  tanks.  The  capability  to  determine  these 
quantities  accurately  will  present  an  impact  on  design  of  the  system. 

4.3.3  Emergency  Propellant  Offloading  on  the  Pad 

The  position  of  stowage  in  the  orbiter  cargo  bay  may  or  may  not  be  in 
the  engine  down  mode  for  loading.  From  a system  safety  standpoint  all 
logistic  elements  in  the  cargo  must  be  capable  of  gravity  feed  off  loading 
under  emergency  conditions. 

4.3.4  Disturbance  Coupling  with  Configuration  Dynamics 

The  effect  of  sloshing,  fluid  surface  distortion,  CG  control,  potential 
mass  spills.  Intermittent  RCS  operation  or  uncontrolled  venting  upon  the 
dynamics  of  the  docked  configuration  is  required  to  determine  the  conditions 
the  elements  will  be  subjected  to  during  orbital  operations.  The  outcome 
of  the  effects  will  impact  design  considerations  of  each  element  expected  to 
be  used  in  an  Integrated  configuration. 
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A. 3. 5 Dtmping  of  Propellants  for  Abort  Operation 

In  order  to  make  a successful  orblter  weight  for  landing,  propellants 
from  the  propellant  logistic  element  in  the  cargo  bay  will  have  to  be  off 
loaded.  This  off  load  will  have  to  be  accomplished  within  200  seconds, 
which  is  the  minimum  time  from  a decision  to  abort,  to  landing. 

Since  the  propellant  logistic  elements  weigh  as  much  as  //65,000,  under 
present  estimate  at  least  25,000  lbs.  of  propellants  must  be  dumped  within 
the  200-second  period  for  attaining  an  allowable  loading  weight.  This  dump 
requirement  will  Impact  the  orblter  design  consideration  for  carrying  propel- 
lant logistics  elements  within  the  cargo  bay. 

the  identified  hazards  encompassing  the  representative  orbital  propel- 
lant logistic  operations  when  used  with  the  conditions  contributing  to  the 
hazard,  provide  the  basis  for  development  of  specific  preventive  measures. 
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5.0  PREVENTIVE  MEASURES 

The  objective  of  preventive  measures  was  to  reduce  catastrophic  and 
critical  hazards  to  the  level  of  at  least  marginal  and  preferably  negligible. 
As  each  hazard  was  Identified  on  the  Hazard  Analysis  sheet,  the  steps  to  be 
taken  to  reduce  the  hazard  to  an  acceptable  level  were  detailed  In  the 
"Action  Recommended"  blank.  This  "Action  Recommended"  then  becomes  the 
preventive  measures. 

The  application  of  preventive  measures  that  have  been  successful  In 
reducing  similar  hazards  on  past  programs  were  successful  In  reducing  hazards 
In  propellant  logistics  operations  in  the  majority  of  cases.  Thirty-three 
hazards  were  not  successfully  reduced  below  the  critical  level.  These 
residual  hazards  have  been  Identified  In  this  section  and  Appendix  D. 
Continued  effort  must  be  placed  on  the  reduction  of  these  residuals.  Some 
advancement  In  technology  Is  required  to  reduce  some  hazards.  This  technology 
advancement  Is  Identified  In  this  and  other  sections  of  this  volume. 

The  necessity  for  an  operations  monitor  has  been  Identified  as  well  as 
the  monitoring  devices  that  should  be  Incorporated  to  provide  the  monitor 
with  necessary  data. 

5.1  HAZARD  REDUCTION  PRECEDENCE  SEQUENCE 

The  action  recommended  covers  one  or  more  recommended  means  to  eliminate 
or  reduce  the  hazard.  If  the  hazard  cannot  practically  be  eliminated  the 
actions  for  reducing  the  hazard  In  order  of  precedence  are  those  contained 
In  OMSF  Safety  Program  Directive  No.  1,  Revision  A,  condensed  here  for  the 
convenience  of  the  reader. 

a.  Design  for  minimum  hazard. 

b.  Use  appropriate  safety  devices. 

c.  Provide  devices  for  timely  detection  of  the  condition  and  generation 
of  adequate  warning  signals. 

d.  Develop  special  procedures  to  counter  the  hazardous  condition  and 
enhance  personnel  safety. 

e.  Residual  hazards  shall  be  those  for  which  none  of  the  above  actions 
are  effective  In  counteracting  the  hazard  and  shall  be  justified  and 
documented . 
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5.2  PREVENTIVE  MEASURES  FOR  IN  SPACE  PROPELLANT  LOGISTICS  SAFETY  CRITICAL 

OPERATIONS 

Preventive  measures  were  developed  for  the  safety  critical  operations 
that  would  be  performed  during  deployment,  docking,  transfer  and  retrieval. 

These  operations  were  treated  in  detail  in  Appendix  D but  some  of  the  most 
significant  ones  will  be  discussed  here. 

5.2.1  Deployment 

The  operations  conducted  during  deployment  are  largely  manual  operations. 
The  variables  Introduced  by  the  human  element  are  compounded  by  variables 
brought  on  by  the  different  operating  modes  of  the  vehicles  being  deployed 
and  by  the  limitations  of  the  equipment  visualized  as  being  used  in  the 
deployment  process. 

The  deployment  process  consists  of  all  those  steps  necessary  to  remove 
an  element  from  the  cargo  bay  of  the  prbiter,  translating  it  away  from  the 
orblter  by  rotational  means  or  on  the  slender,  flexible  arms  of  the  manipu- 
lators or  both,  and  preparing  the  element  for  the  next  step,  docking  or 
release. 

When  the  element  is  first  released  from  its  interface  with  the  orblter, 
the  latches  that  are  provided  to  hold  the  element  in  the  cargo  bay  may  bind 
up  or  not  fully  release.  The  preventive  measure  for  this  occurrence  would 
be  the  provision  of  backup  release  mechanisms. 

When  partially  out  of  the  cargo  bay,  uncoordinated  movement  of  the 
manipulator  arms  may  cause  fluid  sloshing  to  be  set  up  that  would  Impact  the 
element  and  cargo  bay  walls.  The  preventive  measure  for  this  hazard  would 
be  the  provision  of  slosh  dampening  devices  that  would  dampen  out  this 
oscillation  before  it  reached  hazardous  proportions. 

Any  time  the  element  is  extended  on  the  slender  manipulator  arms 
(60  feet  long)  propulsive  venting  of  the  propellant  tanks  would  Introduce 
moments  into  the  system  that  would  produce  tumbling.  If  the  RCS  System  of 
the  orblter  tended  to  correct  the  rotation  the  manipulator  arms  would  be 
bent  or  curved  to  store  up  energy  that  would  be  released  when  the  venting 
stopped.  This  could  set  up  oscillatory  motion  until  dampened  out.  The 
preventive  measure  for  this  hazard  would  be  the  procedural  operation  of 
locking  out  the  vent  valve  of  the  element  to  prevent  venting  during  this 
phase.  The  tank  pressure  would  continue  to  build  up  by  gas  pressure  from 
heat  leaks  and  would  require  monitoring  the  tank  pressure  to  be  sure  it  did 
not  reach  hazardous  levels  until  it  could  be  safely  vented.  An  additional 
hazard  of  this  nature  is  the  propulsive  effect  of  leaking  fluids.  Any 
incident  that  would  lead  to  sudden  leakage  of  significant  volume  (a  2"  diameter 
hole)  would  remain  a residual  hazard. 

The  hazard  of  venting  fluids  would  be  compounded  by  the  visual  restrictions 
that  would  occur  when  "ice"  particles  from  the  venting  fluids  obscured  view 
ports,  TV  lenses  or  other  visual  aids.  Retractable  shields  to  protect  the 
visual  aids  would  be  the  preventive  measure  for  this  hazard. 
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5.2.2  Docking 

The  docking  process  consists  of  all  those  operations  necessary  to  join 
two  Independent  orbiting  units  into  one.  Interdependent  unit.  Docking  can 
be  broken  into  two  broad  classifications,  hard  and  soft. 

Soft  docking  is  done  with  the  assistance  of  the  manipulators  in  the 
orbiter  cargo  bay.  Soft  docking  begins  with  the  orbiter  station  keeping 
in  close  proximity  with  another  vehicle  that  is  to  receive  the  element  from 
the  shuttle  cargo  bay.  The  element  will  have  been  deployed  and  remain 
attached  to  one  or  both  of  the  manipulator  arms.  At  this  point  one  of  the 
manipulator  arms  can  be  attached  to  the  receiving  vehicle  to  maintain  a 
fixed  relationship  between  the  orbiter  and  receiving  vehicle,  or  the  orbiter 
and  receiver  can  retain  free-flying  attitudes  and  both  manipulator  arms  used 
to  bring  the  active  and  passive  docking  elements  into  initial  contact. 

Hard  docking  is  performed  without  the  assistance  of  the  manipulators. 

The  active  element  makes  the  initial  contact  - docking  port  to  docking  port  - 
without  intermediate  assistance. 

After  initial  contact  is  made  by  hard  or  soft  docking  the  remainder  of 
the  steps  in  the  docking  process  are  the  same.  These  consist  of  making  the 
capture,  rigldlzlng  the  Interface  and  completing  the  interface  connections 
to,  in  effect,  join  the  two  vehicles  into  one  in  preparation  for  subsequent 
operations.  The  hazards  and  preventive  measures  that  relate  to  vehicle 
stability  during  the  docking  operations  are  similar  to  the  same  hazards  that 
would  occur  during  deployment  and  are  discussed  there. 

The  docking  approach  angle  and  velocity  is  critical  to  the  success  of  the 
docking  operation.  Docking  mechanisms  must  be  designed  to  accept  contact 
within  small  angular  deviations  from  the  docking  axis.  For  this  reason  the 
two  vehicles  must  be  stable  with  relation  to  the  other  and  the  docking  axis 
aligned  within  a typical  5 degrees.  Attempts  to  dock  when  the  angular 
deviation  is  excessive  could  result  in  one  or  more  capture  latches  falling 
to  capture  and  lead  to  problems  when  separation  is  attempted  for  another 
try.  Excessive  closing  velocity  would  exceed  the  capability  of  the  shock 
attenuation  system  and  cause  structural  damage  on  Impact.  Procedural  con- 
trols and  crew  training  would  be  the  preventive  measures  in  the  manual  case 
and  redundancy  in  the  automatic  case. 

During  the  docking  approach  anything  that  would  tend  to  Introduce 
deviations  in  the  approach  could  lead  to  collision  damage.  These  would 
Include  fluid  sloshing  Introduced  by  unstable  manipulator  operation,  the 
propulsive  effects  of  venting  fluids  and  the  propulsive  effects  of  credible 
leaks.  When  the  two  vehicles  are  being  joined  the  two  RCS  systems  should 
be  integrated  so  they  act  as  one  unit.  If  both  RCS's  remain  independent 
they  would  likely  produce  opposing  thrust  that  would  lead  to  "working"  at 
the  Interface,  possible  structural  damage  or  rapid  depletion  of  RCS  propel- 
lants. The  preventive  measure  for  this  hazard  would  be  to  integrate  the  two 
RCS ' s on  docking . 
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The  hazard  of  large  amounts  of  momentum  energy  being  translated  into 
fluid  movement  during  docking  could  be  dampened  out  by  baffles.  The  contri- 
bution of  this  momentum  to  further  vehicle  instability  should  be  more  fully 
investigated. 

After  the  two  vehicles  are  joined  the  interface  connections,  mechanical, 
fluid  and  electrical  should  be  verified  to  make  sure  they  are  valid  prior  to 
beginning  subsequent  operations. 

For  a more  detailed  treatment  of  docking  preventive  measures,  see 
Appendix  D. 

5.2.3  Propellant  Transfer 

Propellant  transfer,  as  used  in  this  section,  consists  of  those  opera- 
tions necessary  to  translate  fluid  propellants  from  one  tank  into  another. 

After  the  two  vehicles,  the  supplier  and  the  user,  are  joined  and  the 
Interface  connections  have  been  verified  the  propellant  transfer  operations 
can  begin.  Llquid/vapor  interface  control  is  accomplished  by  settling  the 
propellants  by  applying  gravity  Induced  by  acceleration  or  by  the  use  of 
passive  (capillary)  devices.  Acceleration  can  be  applied  by  inducing  rotation 
to  the  assembly  or  by  applying  thrust  in  a linear  fashion.  When  accelerating 
the  assembly  a manned  element  (orblter)  may  or  may  not  be  attached. 

Because  of  the  small  acceleration  forces  involved  the  transfer  period  is 
shortened  to  10  hours  by  pumping  the  fluids  in  conventional  fashion. 

The  hazards  encountered,  to  which  preventive  measures  must  be  applied, 
are  those  that  would  affect  the  stability  of  the  vehicles,  maintaining  the 
transfer  for  extended  periods  of  time,  thermal  effects  on  the  user  and 
behavior  of  propellants  in  zero  "G."  For  a detailed  discussion  of  the  pre- 
ventive measures  to  be  applied  to  the  hazards  Involved  during  propellant 
transfer,  refer  to  Appendix  D. 

5.2.4  Retrieval 

Essentially  the  retrieval  operation  Includes  the  same  hazards  intro- 
duced during  the  deployment  operation,  in  reverse  order,  with  the  additional 
hazards  attendant  to  the  deorbit  of  the  shuttle. 

In  the  preparations  for  deorblt  and  the  deorblt  phase  Itself,  hydrogen 
leakage  into  the  cargo  bay  would  be  a major  hazard.  Prior  to  retrieval  the 
spend  module  should  be  visually  examined  as  a preventive  measure  for  leakage 
either  by  TV  on  the  manipulator  arms  or  from  the  view  port  while  rolling  the 
orblter  around  the  module  or  rotating  the  module  in  view  of  the  crew.  Leak- 
ing fluids  will  be  highly  visible  and  a leaking  module  should  not  be  returned 
by  the  shuttle  until  corrective  action  can  be  taken.  If  no  leaks  are  visible 
and  no  solidified  propellants  are  visible  on  the  module  or  in  the  cargo  bay 
and  the  propellant  utilization  history  of  the  module  does  not  Indicate  high 
losses  the  module  may  be  retrieved  by  the  manipulators  and  placed  in  the  cargo 
bay.  At  this  time  the  hookup  of  the  module  should  be  completed  and  to  guard 
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against  the  hazard  of  propellants  leaking  directly  into  the  cargo  bay,  the 
preventive  measure  should  be  taken  of  leak  checking  the  Interface  connection 
between  the  vent/dump  lines  of  the  module  and  orbiter.  When  It  has  been 
determined  that  this  connection  is  leak  free  the  residual  liquids  should  be 
dumped  from  the  module.  Propellant  dumping  could  be  performed  before  re- 
trieval but  if  it  is  to  occur  during  the  retrieval  cycle  it  should  not  be 
performed  until  the  interface  connection  has  been  leak  checked  as  a preventive 
measure  to  guard  against  the  hazard  of  solidified  propellants  being  deposited 
and  deorbiting  in  the  cargo  bay.  After  completion  of  propellant  dump  the 
entire  hydrogen  system  of  the  module  should  be  leak  checked.  If  the  module 
is  not  leaking  out  of  specification,  normal  leakage  will  not  be  hazardous  to 
the  orbiter  or  crew  on  re-entry. 

5.3  MONITORING  DEVICES 

Providing  propellants  to  a user  in  space  is  a complex  operation  and 
could  be  made  fully  automatic.  For  operations  that  are  repeated  many  times 
and  to  minimize  human  error,  a preventive  measure  was  recommended  that  the 
repetitive  operation  be  automated. 


Even  though  propellant  logistics  could  be  automated,  manned  elements 
(shuttle  orbiter)  will  be  used  as  a delivery  element.  The  introduction  of 
the  manned  element  requires  the  addition  of  another,  the  Operations  Monitor. 


To 

fulfill  the  requirements  of  being  aware  of 

the  progress  of  orbital 

events  would  necessitate  the  provision  of  monitoring  devices  that  would 

include  the  following: 

a. 

Electrical  Power 

b. 

Pneumatic  Supply 

c. 

Valve  Position  Indicators 

d. 

Propellant  Tank  Pressure  and  Temperature 

e. 

Propellant  Gauging 

f. 

Operating  Cycles 

g- 

Leak  Check 

h. 

Line  Interconnect  Fixture  Verification 

1. 

Docking  Latches 

J- 

Redundant  Systems  Status 

k. 

Hazardous  Gas  Detectors 

1. 

Fire  Detectors 

m. 

LSS  Operational  Levels 

n. 

Space  Debris  Warning 

For 

a detailed  discussion  of  these  monitoring 

devices  refer  to  Appendix 

D. 

5.4  RESIDUAL  HAZARDS 

Catastrophic  and  critical  hazards  encountered  in  propellant  logistics 
operations  were  identified  and  analyzed.  The  objective  of  preventive  measures 
was  to  reduce  these  hazards  to  at  least  marginal  and  preferably  negligible. 
After  the  application  of  the  preventive  measures  if  the  hazard  still  remained 
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at  a catastrophic  or  critical  level  then  the  hazard  Is  residual. 

Thirty-three  remained  as  residuals.  These  Include: 

a.  Meteoroid  Impact 

b.  EVA  Operations 

c . Propellant  Quantity 

d.  Disturbances 

e.  Propellants  Venting  Into  Cargo  Bay 

f.  Deorb It 

g.  Docking  Between  Unstable  Vehicles 

h.  Manual  Docking  Operations 

1.  Reduction  of  Vision 

For  a detailed  discussion  of  these  and  other  residual  hazards  refer  to 
Appendix  D.  Continued  emphasis  should  be  placed  on  the  reduction  of  these 
residuals.  As  the  configuration  of  the  hardware  and  the  operation  of  this 
hardware  approaches  maturity,  available  technology  and  study  should  continue 
to  be  applied  to  hazard  reduction. 

5.5  CONCLUSIONS 

During  the  course  of  this  study  It  was  found  that  preventive  measures 
that  had  been  used  on  past  programs  could  be  used  to  reduce  hazard  potential 
for  propellant  logistics  operations  In  the  majority  of  cases.  The  application 
of  these  preventive  measures  did  not  reduce  the  hazard  potential  to  an  accept- 
able level  In  33  cases.  The  development  of  future,  similar  programs  should 
Include  the  application  of  these  preventive  measures  and  continued  emphasis 
on  the  reduction  of  the  residual  hazards.  In  certain  cases  (propellant 
gauging,  for  example)  It  was  found  that  advancement  in  the  state-of-the-art 
was  necessary  to  develop  preventive  measures. 

The  requirement  for  an  Operations  Monitor  was  established,  even  though 
propellant  logistics  Is  fully  automatic.  Some  of  the  data  that  must  be  pro- 
vided to  the  Operations  Monitor  was  defined.  As  the  design  of  propellant 
logistics  hardware  proceeds  continued  study  should  be  applied  to  the  defini- 
tion of  additional  monitoring  devices  that  would  be  required. 
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6.0  TRADE  STUDIES 


In  the  Representative  Orbital  Propellant  Logistic  System  baseline 
operations  with  variations,  it  becomes  evident  the  viable  options  for 
accomplishing  certain  operations  would  require  evaluation  for  determining 
the  hazards  involved  with  the  option  and  the  safest  conceptual  approach. 
This  section  includes  safety  evaluations  for  rotational  and  manipulator 
deployment  mechanisms  which  involve  hard  and  soft  docking  respectively, 
Options  of  the  Orbiter  attached  or  not  attached  during  fluid  transfer,  and 
tug,  CIS/RNS,  modular  element,  and  orbiter  to  orbiter  options  for  delivery 
of  propellants  direct  to  a user. 

The  deployment  mechanism,  Orbiter  attached  or  not  attached,  and 
orbiter  to  orbiter  evaluations  were  made  using  safety  considerations 
applicable  to  the  specific  evaluation,  while  the  various  space  element 
(Tug,  CIS,  Modular)  options  for  propellant  transfer  were  evaluated  against 
a common  set  of  safety  considerations.  These  safety  considerations  are  as 
follows. 

a.  Number  of  Critical  Operations 

This  evaluates  the  critical  operations  covering  the  orbital 
operations  from  the  time  the  orbiter  arrives  with  the 
propellant  tank  module  through  deployment,  docking,  transfer 
and  retrieval. 

b.  Number  of  Failure  Effects 

1,  On  the  Crew 

This  item  evaluates  the  major  potential  hazards  to  the 
crew  as  a result  of  the  affects  of  a failure  during 
deployment,  docking,  transfer  and  retrieval. 

2.  On  the  Structure 

This  item  evaluates  the  major  potential  hazards  to  the 
structure  as  a result  of  the  affects  of  a failure  during 
critical  operation. 

c.  Crew  Exposure  to  Risks  During  Normal  Operations 

This  evaluation  item  covers  the  risks  associated  with  a time 
line  during  which  the  propellant  logistic  elements  are  engaged 
in  fluid  transfer. 

d.  Attitude  Control  Capability  of  Total  Configuration 

This  evaluation  item  covers  those  aspects  of  the  configuration 
dealing  with  control  of  disturbances,  structural  interaction  and 
RCS  operation. 
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e.  Impact  Control 

This  evaluation  item  covers  those  operations  during  deployment, 
docking,  transfer  and  retrieval  which  are  directly  relatable  to 
potential  impact  conditions. 

f.  Man-Compatibility 

1.  Logistic  Element  (Tug,  CIS/RNS,  Modular) 

This  evaluation  item  covers  the  requirements,  or  lack  thereof, 
of  man-rating  of  the  element  as  it  relates  to  its  functioning 
in  relation  to  the  orbiter. 

2.  Propellant  Tank  Module 

This  evaluation  item  covers  the  requirements,  or  lack  thereof, 
of  man-rating  of  the  tank  module  as  it  relates  to  its  function- 
ing in  relation  to  the  orbiter. 

g.  Communication  Control 

This  item  evaluates  the  continuity  of  maintaining  communications 
in  the  operational  mode  during  transfer. 

h.  Leakage  Control 

This  evaluation  item  covers  the  major  factors  contributing  to 
leakage,  by  configuration. 

The  deployment  mechanism  evaluations  indicated  each  type  of  option 
had  advantages  relating  to  specific  operations • while  a combination  of  both 
was  best  for  certain  operations.  As  an  example  the  rotational  deployment 
provides  more  control  of  clearances  between  the  propellant  tank  module  and 
the  cargo  bay  walls  than  the  manipulator,  while  the nanipulator  provides 
less  impact  potential  with  the  passive  vehicle  because  of  less  impact 
velocity.  The  combination  of  both  is  best  when  the  propellant  tank  module 
is  soft  docked  to  another  logistic  element. 

The  orbiter  attached  or  not  attached  safety  evaluation  indicated 
greater  safety  is  required  with  the  orbiter  attached,  however,  if  all  mated 
configurations  are  man-rated  the  choice  reduces  to  the  commitment  time  of 
the  crew  for  the  operation. 

The  trade  study  for  four  viable  tug  transfer  concepts  concluded  the 
safety  preferred  concept  was  non-deployment  of  the  propellant  tank  module 
with  rotational  acceleration  for  propellant  settling.  The  tug  is  soft 
docked  to  the  propellant  tank  module.  This  selection  had  the  advantage  of 
reducing  the  number  of  critical  operations  in  the  cargo  bay.  A close 
second  preference  was  the  concept  where  the  tank  module  is  deployed  and 
docked  to  the  tug  and  then  the  fluid  transfer  is  accomplished  in  a 
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separated  mode  using  linear  acceleration  for  propellant  settling. 

The  safety  trade  for  four  CIS/RNS  transfer  concepts  concluded  the 
preferred  propellant  transfer  mode  was  with  the  CIS/RNS  and  module 
attached  and  linearly  accelerated  for  transfer. 

Safety  evaluation  of  a conceptual  modular  concept  of  the  CIS/RNS  type 
indicated  it  to  be  competitive  with  the  non-modular  approach. 

Of  the  three  arbiter  to  arbiter  transfer  concepts  evaluated,  no  safety 
preference  could  be  defined.  As  the  configuration  reaches  maturity 
additional  trades  should  be  conducted. 

A detailed  discussion  is  contained  in  the  following  paragraphs. 


6.1  INTRODUCTION 

Safety  evaluations  were  made  of  two  deployment  mechanisms,  two  modes 
of  operation  for  propellant  transfer,  four  tug  concepts,  four  CIS/RNS 
concepts,  one  modular  concept,  and  three  arbiter  to  orbiter  propellant 
transfer  concepts. 

6.1.1  Evaluation  of  Deployment  Mechanisms 

During  the  safety  study,  evaluation  of  deployment  mechanisms  was  made 
to  support  the  analysis  of  operations  in  which  the. deployment  mechanisms 
were  involved.  This  evaluation  provided  insight  into  operations  where  use 
of  the  manipulators  provided  better  concept  from  the  safety  standpoint,  and 
those  operations  where  a rotational  deployment  mechanism  provided  greater 
safety.  See  Section  6.2  for  evaluation  of  deployment  mechanisms. 

6.1.2  Orbiter  Attached  Vs.  Orbiter  Not  Attached  for  Propellant  Transfer 

With  the  variations  to  the  representative  orbital  propellant  logistic 
operations,  which  Introduced  propellant  direct  supply  to  the  user,  the 
orbiter  became  Involved  in  the  fluid  transfer  process.  With  the  potential 
use  of  rotational  or  linear  acceleration  for  propellant  settling,  the 
orbiter  may  be  either  attached  during  the  process  or  not  attached.  A 
safety  evaluation  was  thus  made  on  these  two  possible  modes  of  operation 
of  the  orbiter.  The  evaluation  is  contained  in  Section  6.3. 

6.1.3  Tug  Concepts 

The  above  evaluations  were  used  along  with  the  conditions  contributing 
to  hazards  identified  for  the  propellant  transfer  operations,  in  performing 
a safety  trade  study  on  four  tug  transfer  concepts  considered  candidates 
for  the  case  of  orbiter  direct  to  user  propellant  transfer.  The  trade 
study  is  contained  in  Section  6.4  with  rationale  and  preferred  configura- 
tion. This  trade  study  was  made  oh  a safety  basis  and  selection  was 
Independent  of  programmatic  or  engineering  considerations. 
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6.1.4  CIS/RNS  Concepts 

The  same  type  of  trade  study  as  that  for  the  tug  concept  was  done  for 
the  CIS/RNS  concept.  In  these,  four  CIS/RNS  configurations  were  candidates 
for  evaluation  from  a safety  viewpoint.  For  convenience  these  were  called 
Concepts  A,  B,  C and  D.  Concepts  A and  B involved  rotational  acceleration 
for  propellant  settling  with  "A"  having  no  orbiter  attached  while  "B"  had 
the  orbiter  attached.  Both  concepts  A and  B have  CG’s  falling  within  the 
CIS/RNS  tankage.  This  consideration  was  a factor  in  deciding  to  discard 
concept  A from  the  trade  since  concept  B included  hazards  which  when 
evaluated  also  would  include  the  conditions  of  concept  A.  The  trade  study 
is  contained  in  Section  6.5  with  rationale  and  safety  preferred  selection. 

6.1.5  Modular  Concept 

A single  modular  concept  was  evaluated  for  comparative  purposes  with 
the  CIS/RNS.  The  evaluation  is  contained  in  Section  6.6.  Since  only  one 
concept  was  evaluated  no  safety  preference  was  made. 

6.1.6  Orbiter  to  Orbiter  Concept 

One  variation  to  the  Representative  Orbital  propellant  logistics 
operations  baseline  involved  delivery  of  propellants  by  the  orbiter  to 
another  orbiter.  This  case  was  evaluated  for  three  different  methods  of 
transferring  propellants  in  orbit  between  orbiter  elements,  from  a safety 
standpoint  only.  There  was  no  method  selected  as  preferred  from  a safety 
viewpoint  as  the  changes  in  orbiter  configuration  and  location  of  the  RCS 
and  QMS  make  selection  premature.  The  evaluation  is  contained  in 
Section  6.7. 

6.2  SAFETY  EVALUATION  OF  MANIPULATOR  VS  ROTATIONAL  DEPLOYMENT  MECHANISMS 
6.2.1  Introduction 


In  the  propellant  logistic  operations  the  Orbiter  will  have  a 
requirement  for  deploying  a propellant  tank  module  from  the  cargo  bay  for 
docking  to  a user  vehicle.  The  objective  was  to  evaluate,  from  a safety 
viewpoint,  two  different  deployment  mechanisms  which  are  viable  candidates 
for  use  in  propellant  logistic  operations.  This  evaluation  was  needed  for 
consideration  of  hazards  associated  with  orbiter  cargo  bay  operations 
involving  propellant  tank  module  deployment. 

6.2.2  Summary  of  Results 

It  was  concluded  from  the  evaluation  that  in  the  propellant  logistics 
operations  there  is  no  clear  cut  overall  advantage  in  one  mechanism  over 
the  other.  Each  mechanism  has  advantages  and  disadvantages  which  are 
directly  associated  with  the  specific  operation;  a.g.,  the  case  where  the 
impact  hazard  due  to  sloshing  of  propellants  during  deployment  out  of  the 
cargo  bay  is  reduced  by  use  of  the  rotational  deployment  mechanism  where 
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clearance  control  is  a function  of  structure  (tank)  deflection,  compared 
to  impact  during  sloshing  as  a function  of  manipulator  dynamics  and 
control  operations. 

Alternatively,  the  manipulator  mechanism  use  for  soft  docking  affords 
fewer  impact  hazards  causing  major  damage  when  docking  at  0.1  feet  per 
second,  than  hard  docking  with  the  rotational  mechanism  at  1 feet  per 
second. 

From  a safety  standpoint  a combination  of  the  two  concepts  applied  to 
the  deployment,  docking  and  retrieval  operations  would  pro’^ide  greater 
safety  than  either  individual  concept. 

6.2.3  Safety  Considerations  and  Evaluation  of  Manipulator  Mechanism 
vs  Rotational  Mechanism 

The  safety  considerations  used  in  the  evaluation  are  contained  in 
Table  6. 2. 3-1.  The  evaluation  considered  those  conditions  relating  to 
propellant  logistic  operations  in  orbit  and  are  also  included  in  Table  6. 2. 3-1. 

6.2.4  Rationale  for  Safety  Consideration 

The  rationale  for  this  evaluation  by  item  is  as  follows. 

a.  Item  1 - In  removing  the  propellant  tank  module  from  the 

cargo  bay,  movement  of  the  fluids  (LH2  LO2)  by  erratic  operation, 

RCS  thrust,  venting,  uncontrolled  leakage  or  operation  of 
propulsion  vents  on  the  orbiter,  could  cause  sloshing.  When 
suspended  on  the  manipulator  with  the  propellant  tank  not 
completely  withdrawn  from  the  cargo  bay  the  dynamics  of  the 
manipulator  could  result  in  problems  of  maintaining  clearance 
under  sloshing  conditions. 

For  the  rotational  deployment  mechanism,  the  structural  rigidity 
of  the  mechanism  and  load  are  fixed  through  the  docking  mechanism. 
Sloshing,  occurring  during  tank  deployment,  is  restrained  by  the 
tank  structure,  which  should  not  deflect  to  the  point  of  impacting 
the  cargo  bay  walls.  The  structural  rigidity  should  provide  more 
wall  clearance  control  in  this  case. 

b.  Item  2a  - In  attaching  the  manipulator  to  the  propellant  tank, 
the  operation  is  done  using  TV  aids  and  floodlights  in  making 
contact  with  the  attachpoint.  Erratic  manipulator  operations 
could  create  an  Impact  with  the  module. 

The  rotational  mechanism  Is  attached  to  the  module  during  ground 
operations  and  thus  requires  no  In-f light  connection  operations. 
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Item  2b  - The  retrieval  operation  requires  matching  orbit  and 
speed  with  the  passive  vehicle  and  through  use  of  manipulator 
aids,  attaching  the  manipulator  to  the  module.  The  potential 
for  impact  of  the  manipulator  with  the  module  is  present  and  is 
a function  of  manipulator  operators  skill  and  orbiter  stabiliza- 
tion. 

The  module  must  be  retrieved  by  hard  dock  in  the  case  of  the 
rotational  mechanism.  On  a basis  of  velocity  control  and 
energy  involved  in  the  hard  dock  operation,  it  is  envisioned 
less  damage  potential  exists  with  the  manipulator  operation 
than  that  for  the  rotational  mechanism. 

c.  Item  3 - Because  of  the  energy  transfer  involved  in  docking 
the  propellant  logistic  elements  to  each  other,  the  lower  the 
approach  velocity,  the  less  damage  from  impact  could  be  expected. 
The  manipulator  operates  at  approximately  0.1  feet/sec.  while  the 
hard  dock  is  approximately  1 foot/sec.  Thus  hard  dock  to  the 
rotational  mechanism  would  give  more  impact  for  the  same  module. 

d.  Item  4 - The  dynamics  of  the  long  manipulator  arms  with  the 
propellant  tank  module  attached  Introduces  more  susceptibility  to 
disturbances  of  sloshing,  RCS,  propulsive  vent  operation  or 
uncontrolled  venting  than  the  rotational  deployment  mechanism 
plus  module  because  the  latter  is  structurally  attached  to  the 
orbiter  with  less  deflection  potential. 

e.  Item  5 - The  rotational  deployment  mechanism  folds  into  the  cargo 
bay  and  the  entire  structure  can  be  secured  with  latches  at  point 
of  final  travel.  The  manipulators  must  be  laid  into  the  volume 
on  either  side  of  the  cargo  bay.  Because  of  their  length  and 
joints,  it  was  considered  more  difficult  than  the  rotational 
mechanism  stowing. 

f . Item  6 - Because  of  the  manipulator  length  plus  length 

of  the  extended  module,  greater  separation  is  provided  between 
the  orbiter  and  passive  vehicle  than  in  the  rotational  device 
with  module  attached. 

g.  "item  7 - This  case  is  a function  of  the  control  operators 

ability  and  the  dynamic  response  to  disturbances.  Because  of 
the  dynamics  involved  and  moments  which  are  created  therewith, 
the  manipulator  is  considered  to  afford  less  control  stability 
than  the  rotational  mechanism. 

h.  Item  8 - This  case  involves  the  movement  of  fluids  within  the 
tank  such  that  a CG  excursion  can  be  expected  which  could  be 
amplified  by  the  dynamics  of  the  manipulator.  Those  dynamics 
conditions  do  no-t  present  as  great  a reaction  in  the  case  of 
the  rotational  mechanism  which  provides  better  stability  under 
sloshing  conditions. 
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i.  Item  9 - The  manipulator  has  flexibility  in  movement  such  that 
not  as  much  stability  is  needed  in  the  passive  vehicle,  as 
alignment  can  be  varied  by  the  control  operations . Where  a 
passive  vehicle  is  not  completely  stable,  hard  docking  using  the 
rotational  deployment  mechanism  concept  should  not  be  attempted. 

j . Item  10  — The  rotational  deployment  mechanism  is  raised  and 
lowered  by  actuators  without  any  complicated  control  device.  The 
manipulators  are  made  up  of  various  segments  and  joints  each 
capable  of  performing  a particular  function.  These  joints  have 
electrical  motors  for  powering  their  operation.  For  redundancy 
there  are  two  manipulators  each  having  TV  cameras  and  floodlights 
mounted  thereon.  The  controls  for  the  manipulator  functions 
therefore  require  more  operations  for  assuring  a coordinated 
deployment  and  retrieval. 

k.  Item  11  - For  the  manipulator  operations  during  deployment  the 

TV  aids  and  direct  observations  will  have  to  be  used.  Depth  per- 
ception, therefore,  becomes  a factor  in  estimating  the  clearance  of 
the  tank  from  the  cargo  bay  walls,  doors,  etc.  In  using  the 
rotational  mechanism  for  deployment  or  retrieval,  depth  perception 
is  not  a factor. 

l.  Item  12  - In  the  rotational  deployment  mechanism  the  potential 
mechanical  failure  points  are  considered  to  be  at  the  hinge  points 
and  at  the  actuator  attach  points.  This  failure  could  be  a 
result  of  a hard  dock  or  Impact  due  to  misalignment.  The 
manipulators  have  joints,  hinges  and  rotating  points  where 
mechanical  failure  could  occur.  These  failures  could  be  due  to 
deflection  under  load  or  structural  failure.  The  number  and 
complexity  of  the  mechanical  systems  thus  indicates  more  potential 
failure  points  exist  in  the  manipulator. 

m.  Item  13a  - See  Item  1. 

n.  Item  13b  - Because  of  the  greater  separation  distance  between 
active  and  passive  vehicles  while  using  manipulators,  there  is 
less  potential  for  impact.  An  assumption  used  here  was  that  the 
passive  vehicle  would  be  completely  stable  and  propellant 
sloshing  or  other  disturbances  did  not  exist  at  the  time  of 
docking  preparation  and  during  docking.  The  assumption  applied 
to  use  with  both  deployment  mechanisms. 

o.  Item  13c  - Case  1 applies  to  the  clearance  problem  leading  to 
impact  during  emplacement  in  the  cargo  bay.  The  stowing  by 
manipulator  requires  depth  perception  and  coordinated  operator 
action  in  order  to  locate  the  tank  properly  in  the  cargo  bay 
attach  points.  This  is  considered  more  difficult  and  contains 
more  impact  potential  than  the  rotational  deployment  mechanism 
which  by  its  indexed  location,  will  place  the  tank  into  the  attach 
points  without  requiring  any  operator  depth  perception,  and 
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will  be  controlled  by  limit  switch  at  latching. 

p.  Item  14  — Because  of  the  lower  docking  velocities  of  the 
manipulator  compared  to  "hard  docking",  the  impact  of  a missed 
docking  attempt  will  have  less  transfer  of  energy,  than  that 
employing  a rotational  deployment  mechanism  in  hard  docking. 

q.  Item  15.-  The  rotational  deployment  mechanism  is  expected  to  have 
few  conditions  which  preclude  smooth  operations  in  an  orbital 
operation.  Because  of  the  dynamics  of  the  manipulators  under 
deflection  from  sloshing  conditions  or  bending  joints  it  has 
greater  potential  for  erratic  operation. 

r.  Item  16  - The  use  of  manipulators  in  payload  deployment  for  both 
large  and  small  payloads,  other  than  logistic  elements,  or  where 
docking  the  payload  to  a delivery  element,  has  greater  flexibility 
of  utilization.  The  close  proximity  of  the  orbiter  when  attempting 
to  hard  dock  a small  payload  using  the  rotational  deployment 
mechanism  also  increases  the  potential  for  impact  between  the 
delivery  element  and  orblter/payload. 

s.  Item  17  - It  is  postulated  that  the  manipulator  can  provide  more 
assistance  in  EVA’s,  and  emergencies  where  a module  retrieval  may 
lessen  the  extent  of  the  hazard  to  crew  members  or  where  a crew 
member  doing  EVA  has  become  detached  from  his  structural  support 
such  that  he  is  "free  floating".  The  rotational  mechanism  could 
do  little  in  supporting  these  conditions. 

t.  Item  18  - Because  the  manipulator  is  flexible  under  loading,  if 
a capture  latch  should  hang  up,  the  combination  of  the  low 
velocity  and  the  deflection,  would  cause  less  rotation  to  be  im- 
parted to  the  passive  vehicle  than  from  a hard  docking  attempt 
using  the  rotational  mechanism. 

u.  Item  19  - More  separation  can  be  maintained  under  any  angle  of 
docking  approach  when  using  the  manipulators  extended.  This  angle 
after  manipulator  attachment,  can  be  adjusted  for  docking  to  give 
the  least  potential  for  impact  between  active  and  passive  vehicles. 

There  would  be  no  horizontal  docking  approach  as  the  axis  of  the 
propellant  tank  module  is  90°  to  the  shuttle  axis.  In  this  case 
or  possibly  an  intermediate  position  the  distance  between  active 
and  passive  vehicles  is  reduced  and  the  docking  axis  is  fixed  rela- 
tive to  the  tank  module  axis.  Because  of  the  hazard  related  to  Impact 
between  vehicles,  the  manipulator  can  under  any  angle  maintain 
greater  separation. 

V.  If  an  attempt  is  made  to  deploy  the  logistic  element  and  proper 
release  of  the  cargo  bay  attach  fittings  has  not  been  effected, 

the  manipulators  will  deflect  or  slip  under  the  excess  loading. 
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This  would  be  noticed  by  the  control  operator  and  the  operation 

could  be  stopped  before  damage  occurs.  Under  the  same  condition 
for  the  rotational  deployment  mechanism,  any  rotational  travel  of 
the  platform  ylll  cause  damage  of  the  logistic  element,  when  the 
load  is  applied. 

w.  Item  21  - Because  of  the  length  and  shape  the  manipulator  can 

assume  in  any  position,  the  problem  of  jettisoning  the  manipulator 
presents  more  risk  of  damage  to  the  orbiter  than  the  ejection  of 
the  structure  of  the  rotational  deployment  mechanism,  whose 
configuration  remains  unchanged. 

6.3  SAFETY  EVALUATION  OF  ORBITER  ATTACHED  VS  ORBITER  NOT  ATTACHED 
FOR  PROPELLANT  TRANSFER 

6.3.1  Introduction 


In  the  propellant  logistic  transfer  operation  the  orbiter  may  be 
attached  during  the  transfer  process,  or  it  may  be  at  a stand-off  position. 
The  objective  was  to  evaluate  the  case  of  the  orbiter  attached  vs  not 
attached  during  propellant  transfer  from  a safety  viewpoint,  independent 
of  any  specific  configuration.  This  evaluation  was  needed  for  consideration 
of  hazards  for  cases  where  the  orbiter  delivered  propellants  direct  to  the 
user. 

6.3.2  Summary  of  Results 

It  was  concluded  from  the  results  that  the  requirements  for  safety  of 
combined  configurations  are  greater  when  the  orbiter  is  attached.  Having 
integrated  the  man-rated  requirements  into  attached  systems  the  driving 
consideration  is  the  time  the  orbiter  crew  will  be  committed  to  the  transfer 
operation. 

6.3.3  Safety  Considerations  and  Evaluation  of  Orbiter  Attached/Not  Attached 

The  safety  considerations  used  in  the  evaluation  are  contained  in 
Table  6. 3. 3-1.  The  evaluation  considers  only  those  cases  involved  in 
propellant  transfer  operations. 

6.3.4  Rationale  for  Case  or  Condition 

a.  Item  1 - The  hazards  to  the  orbiter  crew,  by  their  close 
proximity,  is  the  greatest  when  attached.  The  transfer  without 
the  orbiter  attached  is  remote  from  the  control  operator'  and  in 
the  event  of  any  hazards,  the  mission  may  be  lost  with  no  effect 
on  the  crew. 

b.  Item  2 - Potential  for  loss  of  attitude  control  is  least  with  the 
orbiter  attached  principally  because  of  the  reactive  Inertias, 

The  large  mass  of  the  orbiter  with  a relatively  light  tug 
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attached  can  damp  out  disturbances  during  the  four  operative 
conditions  listed.  This  coupled  with  the  superior  instrumentation 
of  the  orbiter  control  system  provides  less  risk  than  having  a 
remotely  operated  light  mass  reacting  to  disturbances  and  CG  shift. 
The  fluid  surface  distortion  coupled  with  RCS  action,  when 
remotely  controlled,  could  possibly  produce  severe  oscillations 
in  pitch  or  yaw. 

c.  Item  3a  - Impact  damage  during  hard  dock  with  the  orbiter  attached 
appears  to  have  less  risk  of  damage  than  when  not  attached.  This 
is  predicated  on  the  assumption  that  impact  attenuation  will  be 
provide4  for  both  cases  and  that  better  control  of  the  operation 
is  provided  by  the  orbiter  crew  in  conjunction  with  its  superior 
control  capability.  Docking  aids  will  also  be  backed  up  with  visual 
observations,  whereas  in  the  not  attached  case  the  operation  is 
remote  and  control  using  TV  aids  may  be  more  difficult  in  judging 
distances,  conditions,  etc.,  leading  to  a greater  Impact  potential. 


d.  Item  3b  - There  is  no  major  preference  in  this  case.  With  the 
orbiter  manipulators  attached,  one  to  the  propellant  module  and 
one  to  the  receiver,  the  two  could  be  soft  docked  by  slowly 
bringing  the  two  elements  together.  Impact  by  loss  of  coordinated 
action  could  occur  with  minor  disturbances.  In  the  case  where 
the  manipulators  do  not  control  the  receiver  and  module  but  just 
the  module,  stationkeeping  alignment  and  docking  can  cause 
potential  impact  damage  in  the  case  of  a missed  docking  with 
capture  by  one  latch  on  the  docking  fixture,  plus  disturbances. 

The  preference  was  thus  given  to  the  attached  condition. 

e.  Item  4 - Because  of  the  man- in- the- loop  considerations  with  the 
orbiter  attached,  the  entire,  configuration  should  be  man-rated. 

The  items  a through  o are  essentially  increased  efforts  in  design, 
engineering,  and  test  which  must  be  taken  in  the  interest  of  crew 
safety.  Where  the  orbiter  is  not  attached  the  factors  will  be 
somewhat  reduced. 

f.  Item  5 - Since  the  crew  will  not  be  exposed  directly  with  the 
orbiter  not  attached,  the  greater  exposure  is  with  the  orbiter 
attached. 

g.  Item  6 - This  relates  to  the  number  of  operations  involving 
mating  and  demating  in  the  process.  For  the  case  of  the  orbiter 
attached,  transfer  line  hookup  can  be  made  to  involve  only  one 
mating  and  demating.  In  the  operation  of  removing  the  propellant 
module  out  of  the  cargo  bay  and  mating  to  the  receiver  there  are 
two  matings  and  two  dematings  required  to  return  the  configura- 
tions to  the  same  condition  in  the  cargo  bay.  Thus  the  orbiter 
attached  case,  having  fewer  operations  and  which  eliminates 
disconnect  in  the  cargo  bay,  has  fewer  hazards.  These  hazards 
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are  leaking  propellants,  damaged  insulation,  lost  pressuriza- 
tion through  leaking  QD  seal,  etc.  These  hazards  are  involved 
in  the  case  of  the  orblter  not  attached,  however,  as  stated 
before,  they  are  not  involved  In  the  orbiter  attached  case. 

h.  Item  7 - In  both  the -cases  a and  b,  with  the  orbiter  attached 
failure  of  the  deployment  mechanism  stabilization  linkage 
could  cause  a rotational  movement  which  would  cause  impact 
with  the  orbiter  during  spin  up  or  spin  down,  or  during  the 
linear  acceleration.  The  exception  is  the  case  where  the  tank 
module  is  not  deployed  out  of  the  cargo  bay.  In  this  exception 
the  hazards  are  fewer  and  comparable  to  the  case  where  the 
orbiter  is  not  attached. 

i.  Item  8 - In  the  rotational  mode  the  rotating  configuration 
can  blank  out  the  signal  to  ground  control  unless  antenna 

. . location  considers  this  condition.  The  antennas  in  a linear 
acceleration  mode  are  capable  of  orientation  without  blackout. 

Thus  the  linear  acceleration  mode  was  considered  the  safer  mode. 

j . Item  9 - In  the  case  where  the  orbiter  is  not  attached,  a 
catastrophic  failure  would  cause  loss  of  mission  but  the 
orbiter  and  crew  would  not.  be  affected  at  their  standoff 
position.  With  the  orbiter  attached,  the  same  catastrophic 
failure  could  also  damage  the  orbiter,  with  loss  of  mission. 

The  loss  of  the  orbiter  and  crew  is  a potential  possibility.. 

6.4  SAFETY  COMPARISON  OF  FOUR  TUG  PROPELLANT  TRANSFER  CONCEPTS 

6.4.1  Introduction 

Four  concepts  were  evaluated  from  a safety  viewpoint  involving  the 
tug  element  in  a fluid  transfer  operation.  The  orbiter  was  considered 
attached  In  three  concepts  and  not  attached  In  the  fourth.  The  objective  of 
this  study  was  to  Identify  the  concept  preferred  from  a system  safety  stand- 
point. These  tug  transfer  concepts^nvqlved  the  orbiter  attached  for  both 
rotational  and  linear  acceleration  and  detached  tank  module  with  linear 
acceleration  for  propellant  settling. 

6.4.2  Summary  of  Results 

Of  the  four  configurations  evaluated.  Concept  A,  using  rotational 
transfer  with  logistic  tank. in  the  cargo  bay,  when  provided  with  an  Apollo 
type  probe  at  the  docking  interface,  is  preferred  from  the  system  safety 
viewpoint  over  the  other  approaches.  The  difference  between  Concept  A 
and  Concept  D does  not  appear  to  present  a, major . safety  problem. 

See  Table  6.4. 2-1. 
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6.4.3  Candidate  Concepts 

The  four  candidate  configurations  evaluated  from  a safety  viewpoint 
are  schematically  portrayed  in  Figures  6.4. 3-1  through  6. 4. 3-4.  Concept  A 
was  rotational  transfer  with  logistic  tank  in  the  cargo  bay;  Concept  B was 
rotational  transfer  with  orbiter  attached  and  propellant  tank  module 
deployed;  Concept  C was  linear  transfer  with  orbiter  attached  and  propellant 
tank  module  deployed;  and  Concept  D was  linear  acceleration  of  tug  with  tank 
module-orblter  not  attached. 


CONCffTA 

ROPBIANT  SmUS  TO  OPPOSlTt  ENOS  OF  TANKS 
. . DUUNG  TKANSFB  AS  IT  DOES  ON  KELAUNCH  FILL 

•OTATION  in  PLANE 
OF  PAPa  fO«  SETTUNO 


CLOa  PKOXiAITY  OF  CG  TO  TANK 
WIUIKOUnEHIGHa 
lOTATION  lATE 


TUG  TANK  ULLAGE  LOCATIONS  WIU 
KOURE  CHANGE  IN  VENT  LOCAHON 
A aOPELLANT  GAGING  STSTBA 


MANIPULATOR 


LOGISTIC  TANK  RtAAINS 
IN  ORMTB  CARGO  BAY 


COMBINED  CG 
TUGFUa,  TANK  BAP1Y 

COMBINED  CG 

TUG  BAPTY,  TANK  FUU 


TAP«  OUnn  LOCATIONS 
OETBMINED  BY  SETTLED  KOPELLANT 
AT  EM>  OF  TRANSFa 


Figure  6. 4. 3-1  RotatloiiRl  Trimefer  with  Logistic  Tank  in  Cargo  Bay 
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CONCEPT* 


nOPHiANT  SETTLES  TO  SAME  ENOS  OF 

ROTATION  IN  PLANE  OF  PAPBt  TANKS  ON  PAD  & DURING  TRANSFBl 

FOR  SETTUNG 


Figure  6. 4. 3-2  Rotational  Transfer  with  Orbiter  Attached 


PROPELLANT  SETTLES  TO  SAME  ENDS  OF 
TANKS  ON  PAD  & DURING  TRANSFER 


Figure  6. 4. 3-3 


Concept  C Linear  Transfer  with  Orbiter  Attached 
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CONCEPT  0 


LINEAR  ACCaeiATlON 
FOR  SETTLING 


Figure  6. 4. 3-4  Direct  Linear  Transfer  to  Tug  (Orblter  Detached) 


,4.4  Safety  Considerations  for  Evaluating  Propellant  Logistic  Elements 

a.  Number  of  Critical  Operations 

This  evaluates  the  critical  operations  covering  the  orbital 
operations  from  the  time  the  orbiter  arrives  with  the  propellant 
tank  module  through  deployment,  docking,  transfer  and  retrieval. 

b.  Number  of  Failure  Affects 

1.  On  the  Crew 

This  item  evaluates  the  major  potential  hazards  to  the  crew 
as  a result  of  the  affects  of  a failure  during  deployment, 
docking,  transfer  and  retrieval. 

2.  On  the  Structure 

This  item  evaluates  the  major  potential  hazards  to  the  structure 
as  a result  of  the  affects  of  a failure  during  a critical 
operation. 
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c.  Crew  Exposure  to  Risks  During  Nomal  Operations 

This  evaluation  item  covers  the  risks  associated  with  a time  line 
during  which  the  propellant  logistic  elements  are  engaged  in  fluid 
transfer. 

d.  Attitude  Control  Capability  of  Total  Configuration 

This  evaluation  item  covers  those  aspects  of  the  configuration 
dealing  with  control  of  disturbances,  structural  interaction 
and  RCS  operation. 

e.  Impact  Control 

This  evaluation  item  covers  those  operations  during  deployment, 
docking,  transfer  and  retrieval  which  are  directly  relatable  to 
potential  Impact  conditions. 

f . Man-Compatibility 

1.  Tug 

This  evaluation  item  covers  the  requirements,  or  lack  thereof, 
of  man-rating  of  the  tug  as  it  relates  to  its 
functioning  in  relation  to  the  orbiter. 

. 2.  Propellant  Tank  Module 

This  evaluation  item  covers  the  requirements,  or  lack  thereof, 
of  man-rating  of  the  tank  module  as  it  relates  to  its 
functioning  in  relation  to  the  orbiter. 

g.  Communication  Control 

This  item  evaluates  the  continuity  of  maintaining  communications 
in  the  operational  mode  during  transfer. 

h.  Leakage  Control 

This  evaluation  item  covers  the  major  factors  contributing 
to  leakage,  by  configuration. 

Data  supporting  these  considerations  are  contained  in  Tables 
6. 4. 4-1  through  6.4.4-10. 
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6.5  SAFETY  COMPARISON  OF  FOUR  CIS/RNS  TRANSFER  CONCEPTS 

6.5.1  Introduction 


Four  concepts  were  evaluated  from  a safety  viewpoint  involving  the  CIS/ 
RNS  element  in  a fluid  transfer  operation  with  the  orbiter  attached,  and 
three  with  the  orbiter  not  attached.  All  involved  hard  docking  of  the 
propellant  tank  module.  The  objective  of  this  study  was  to  identify  the 
concept  preferred  from  a system  safety  standpoint.  The  CIS/RNS  concepts 
included  rotational  and  linear  acceleration  for  propellant  settling  and 
propellant  control  by  capillary  methods  for  propellant  orientation. 

6.5.2  Summary  of  Results 

Of  the  four  candidate  configurations  evaluated,  the  mode  of  CIS/RNS 
propellant  transfer  preferred  from  a system  safety  standpoint  was  Concept  C 
which  was  the  CIS/RNS  and  propellant  tank  module  docked  and  linearily 
accelerated  for  propellant  settling.  Concepts  C and  D were  rated  overall 
the  same,  however.  Concept  C was  preferred  because  of  the  potential  risks 
in  a capillary  system  In  attainment  of  a safe  system,  considering  the  state- 
of-the-art.  See  Table  6.5.2  for  overall  evaluation  rating. 


6.5.3  Candidate  Concepts 


The  four  candidate  configurations  evaluated  from  a system  safety 
viewpoint  are  schematically  portrayed  in  Figure  6. 5. 3-1. 


SEPARATE  ROTATION 


DEPLOYED  ROTATION 


SEPARATE  LINEAR 


CAPILLARY 


CONCEPT  A 


CONCEPT  B 


CONCEPT  C 


CONCEPT  D 


Figure  6. 6. 3-1  Transfer  Options  for  Typical  CIS/RNS  Concepts 
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EVALUATION  FOR  CIS/RNS  PROPELLANT 
LOGISTIC  ELEMENTS 


OVERALL  RATING 


Space  Division 

North  American  Rockwell 


Concept  A was  rotational  transfer  with  arbiter  not  attached. 

Concept  B was  rotational  transfer  with  orbiter  attached. 

Concept  C was  linear  acceleration  with  orbiter  not  attached. 

Concept  D was  capillary  transfer. 

Concepts  A and  B using  rotational  acceleration  for  propellant  settling 
have  conditions  of  ullage  control  which  result  from  the  CG  of  the  configura- 
tion falling  within  the  CIS/RNS  tankage.  It  was  therefore  decided  to 
evaluate  Concept  B only  since  hazards  of  Concept  A are  Included  in  Concept  B. 
The  hazards  involving  the  orbiter  attached  in  Concept  B thus  gave  a better 
comparison  for  evaluation. 

6.5.4  Safety  Considerations  for  Evaluating  Propellant  Logistic  Elements 

a.  Number  of  Critical  Operations 

This  evaluates  the  critical  operations  covering  the  orbital 
operations  from  the  time  the  orbiter  arrives  with  the  propellant 
tank  module  through  deployment,  docking,  transfer  and  retrieval. 

b.  Number  of  Failure  Affects 

1.  On  the  Crew 

This  item  evaluates  the  major  potential  hazards  to  the  crew 
as  a result  of  the  affects  of  a failure  during  deployment, 
docking,  transfer,  and  retrieval. 

2.  On  the  Structure 

This  item  evaluates  the  major  potential  hazards  to  the 
structure  as  a result  of  the  affects  of  a failure  during  a 
critical  operation. 

c.  Crew  Exposure  to  Risks  During  Normal  Operations 

This  evaluation  item  covers  the  risks  associated  with  a time  line 
during  which  the  propellant  logistic  elements  are  engaged  in 
fluid  transfer. 

d.  Attitude  Control  Capability  of  Total  Configuration 

This  evaluation  item  covers  those  aspects  of  the  configuration 
dealing  with  control  of  disturbances,  structural  interaction  and 
RCS  operation. 

e.  Impact  Control 

This  evaluation  item  covers  those  operations  during  deployment, 
docking,  transfer,  and  retrieval  which  are  directly  relatable  to 
potential  impact  conditions. 
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f . Man-Compatibility 

1.  CIS/RNS 

This  evaluation  item  covers  the  requirements  or  lack 
thereof  of  man-rating  of  the  CIS/RNS  as  it  relates  to 
its  functioning  in  relation  to  the  orbiter. 

2.  Propellant  Tank  Module 

This  evaluation  item  covers  the  requirements  or  lack 
thereof  of  man-rating  of  the  tank  module  as  it  relates 
to  its  functioning  in  relation  to  the  orbiter. 

g.  Communication  Control 

This  item  evaluates  the  continuity  of  maintaining  communica- 
tions in  the  operational  mode  during  transfer, 

h.  Leakage  Control 

This  evaluation  item  covers  the  major  factors  contributing 
to  leakage,  by  configuration. 

Data  supporting  these  considerations  are  contained  in  Tables 
6. 5. 4-1  through  6.5.4-10. 
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Safety  Conaldaratlona  for  Evaluating 
Propellant  Loglatics  Elenents 
Nuotber  of  Critical  Operatlona 


Table 


Table  6.5.4— 1 (Continued) 


Space  Division 

North  American  Rockwell 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-1  (Continued) 


N.A 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-1  (Continued) 


Safety  Considerations  for  Evaluating 

Propellant-  -lioglatlc  Eleaents-  - 

Number  of  Failure  Effects  on  Crew 


37  - 


Table  6. 5.4-2 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-2  (Continued) 


Safety  Considerations  for  Eyalnatlng 
Propellant  Logistic  Elesants- 
Huaber  of  Fallttre  Effects  on  Structure 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-3 


Safety  Conslderatlona  for  Evaluating 
~ -Propellant  1<c^tBt Ic  ^enents 
Exposure  to  Risks  During  Honaal  OperatioAa. 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-4 


Safety  Conaiderationa  for  Evaluating 
Propellimt  Logistic  Elenencs 
Attitude  Control  Capability  of  Total  Configuration 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-5 


Safety  Considerations  for  Evaluating 
Propellant  Logistic  Elements 
i-Compatiblllty  - Propellant  Tank  Module 


Space  Division 

North  American  Rockwell 
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Table  6. 5. 4-8 


Safety  Conaideratioas  for  Evaluating 
Propeiiant  Logiatlc-Eiements- 
CooBunlcation  Control 


Space  Division 

North  American  RcxJ^well 


Table  6. 5.4-9 


Space  Division 

North  American  Rockwell 


6.6  SAFETY  EVALUATION  OF  A MODULAR  CONCEPT  - CIS/RNS  TYPE 

6.6.1  Introduction 

A modular  concept  of  the  CIS/RNS  type  was  evaluated  for  comparative 
purposes  to  a CIS/RNS  fluid  transfer  concept.  The  objective  was  to  evaluate 
a modular  concept  on  the  same  basis  as  used  for  the  four  CIS/RNS  fluid 
transfer  concepts  contained  in  Paragraph  6.5.  This  concept  required  transfer 
of  propellant  tank  modules  rather  than  fluid  transfer  between  elements. 

6.6.2  Summary  of  Results 

The  safety  evaluation  of  the  conceptual  modular  element  indicated  it 
to  be  competitive  with  the  CIS/RNS  (non-Modular  Configuration)  from  a safety 
viewpoint.  This  safety  viewpoint  may  change  when  a firm  configuration  of  the 
Modular  concept  is  developed,  as  the  evaluation  was  made  on  a purely 
conceptual  basis.  See  Table  6.6.2t1  for  overall  rating. 

6.6.3  Candidate  Concept 

The  modular  concept  evaluated  from  a safety  viewpoint  is  schematically 
portrayed  in  Figure  6. 6. 3-1.  This  concept  involves  deployment  of  the  pro- 
pellant tank  module  out  of  the  orbiter  cargo  bay  at  a stationkeeping 
distance  from  the  modular  structure.  The  tank  is  docked  to  a ratable  docking 
fixture  structure  which  is  then  rotated  parallel  with  the  centerline  and 
locked  in  place. 


Figure  6. 6. 3-1  Typical  Modular  Transfer  Concept 
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Space  Division 
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TABLE  6. 6. 2-1 


Space  Division 

North  American  Rockwell 


6.6.4  Safety  Considerations  for  Evaluating  Propellant  Logistic  Elements 

a.  Number  of  Critical  Operations  — This  evaluates  the  critical 
operations  covering  the  orbital  operations  from  the  time  the 
orbiter  arrives  with  the  propellant  tank  module  through  deployment, 
docking,  transfer  and  retrieval. 

b.  Number  of  Failure  Affects 

1.  On  the  Crew:  This  item  evaluates  the  major  potential  hazards 

to  the  crew  as  a result  of  the  affects  of  a failure  during 
deployment,  docking,  transfer,  and  retrieval. 

2.  Hazards  to  the  Structure:  This  item  evaluates  the  major 

potential  hazards  to  the  structure  as  a result  of  the  affects 
of  a failure  during  a critical  operation. 

c.  Crew  Exposure  to  Visits  during  Normal  Operations  - This  evaluation 
item  covers  the  risks  associated  with  a time  line  during  which  the 
propellant  logistic  elements  are  engaged  in  fluid  transfer. 

d.  Attitude  Control  Capability  of  Total  Configuration  - This  evaluation 
item  covers  those  aspects  of  the  configuration  dealing  with  control 
of  disturbances,  structural  interaction  and  RCS  operation. 

e.  Impact  Control  - This  evaluation  item  covers  those  operations 
during  deployment,  docking,  transfer  and  retrieval  which  are 
directly  relatable  to  potential  impact  conditions. 

Han-CoBpatlblllCy 

1.  Modular  Element:  This  evaluation  item  covers  the  requirements, 

or  lack  thereof,  of  man-rating  as  it  relates  to  its  functioning 
in  relation  to  the  Orbiter. 

2.  Propellant  Tank  Module:  This  evaluation  item  covers  the 

requirements  or  lack  thereof,  or  man-rating  of  the  tank  module 
as  it  relates  to  its  functioning  in  relation  to  the  Orbiter  and 
Modular  element. 

g.  Communication  Control  - This  item  evaluates  the  continuity  of  main- 
taining communications  in  the  operational  mode  during  transfer. 

h.  Leakage  Control  - This  evaluation  item  covers  the  major  factors  con- 
tributing to  leakage  of  the  configuration. 

Data  supporting  these  considerations  is  contained  in  Tables  6. 6.4-1 
through  6. 6. 4-8. 
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TABLE  6. 6. 4-1  SAFETY  CONDITIONS  FOR  EVALUATING  PROPELLANT  LOGISTIC  ELEMENTS 

NUMBER  OF  CRITICAL  OPERATIONS  (CONT.) 


Space  Division 

North  American  Rockwell 
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TABLE  6. 6. 4-1  SAFETY  CONDITIONS  FOR  EVALUATING  PROPELLANT  LOGISTIC  ELEMENTS 

NUMBER  OF  CRITICAL  OPERATIONS  (CONT.) 


Space  Division 

North  American  Rockwell 
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Table  6. 6. 4-2  Safety  Consideration  for  Evaluating 
Propellant  Logistic  Elements 


Space  Division 

North  American  Rockwell 
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Table  6. 6. 4-3  SAFETY  CONSIDERATIONS  FOR  EVALUATING 
PROPELLANT  LOGISTIC  ELEMENTS 


Space  Division 

North  American  Rockwell 


41 

to 

m 

41 

C4 

4) 

9 

4) 

8 

u 

•H 

CO 

4J 

3 

9 

rH 

9 

9 

•9 

<4 

cO 

4i 

• 

Vi 

73 

u 

o 

U 

9 

V4  Vi 

O 

rH 

(4 

•H 

9 41 

9 

>1 

(0 

rH 

VI  VI 

8 

O 

c4 

4J 

(0  -H 

CO 

> 

a 

iH 

4) 

iH  ^ 

.rl 

<4 

(0 

9 

•9  Vi 

9 

41 

9 

9 

n 

O 

C4 

Vi 

O 

<4 

4> 

43 

43 

9 

U 

Vi 

VI  43 

U 

VI 

(0 

<4 

iH  4J 

4) 

u 

(0 

•o 

t>^ 

> "rH 

8 

9 

.H 

rH 

1 — I 

Vi 

8 

o 

9 

•9 

00 

VI 

41 

OD 

o 

•H 

4)  VI 

•9 

(0 

UH 

o 

(0 

rH  O 

-H 

o 

9 

<4 

« 

9 14 

44 

Vi 

4J 

O 

>. 

O 

9 9 

U 

c4  • 

9 

U 

tt 

CV 

o 8 

O 

rH  O 

o 

9 

(U 

4) 

H3 

O .r4 

•9 

9 VI 

.H 

a 

X 

•a 

73  41 

VI 

4J 

U 

O 

rH 

“ 9 

41  • 

O Vi 

14 

cn 

to  * 

9 

41  -H 

00  41 

8 4) 

Vl 

j: 

>4  *0 

O 

0) 

14  Vi 

43 

41 

9 

w 

<4  4J 

u 

C4  00 

8 3 

4)  VI 

rH 

o 

•H 

a *J 

41  9 

14  VI 

43 

4) 

K 

o 

8 

rH  -rl 

H3  O 

VI  4) 

u 

(0 

— ^ 

9 9 

to 

4)  VI 

9 

I — 1 

U 

u 

W 

U 

•H 

•H 

Vi  rH 

•9  Vi 

9 9 

CO 

• 

KJ 

M 

c 

4J 

9 

9 

rH  VI 

O 73 

73 

41 

U 

4) 

4)  o 

t4 

43  CO 

9 to 

O 

Vl 

4) 

(w 

i 

9 9 

JS 

O 4) 

O 

a 8 

10 

VI 

M.I 

9 

u 

VI  Vi 

U M 

10 

« 

cO 

M 

o. 

o 

l-t  <*4 

2 

<4 

C4 

•H  44 

9 

4) 

41 

iH 

•H  "H 

8 ♦ 

rH  9 

VI  rH 

9 9 

tH 

Vl 

4> 

O 

to 

o 

9 9 

CO  14 

U 

a 

4)  . 

«4H  >> 

VI  rH 

O fH 

4)  *9 

43  Vi 

9 

o 

•o  m 

9 

9 4) 

Vi  VI 

8 O 

U 

00 

iH 

o 

41 

4J  4J 

4>  iH 

9 C4 

9 8 

41  VI 

9 

9 

•H 

U 9 

8 JC 

VI  VI 

00 

8 9 

.H 

4) 

<4 

9 9 

4)  4) 

S (0 

9 O 

.H  4) 

c4 

Vl 

8 

<4 

(4  rH 

9 1 

o 

<4  Vi 

rH  43 

00  rH 

9 

o 

f— 1 

-H 

9 41 

f-H  VI 

O 

(4  VI 

9 rH 

73 

8 

•4H 

9 

(4 

O Vi 

9.  C4 

9 

(0 

..H  V 

o 

•o 

O 

41  41 

4>  O 

-iH  UH 

44  9. 

43 

o 

9 

h 00 

•9  j: 

Vi  -H 

8 o 

U O 

U 

VI 

£ 

9 

41  9 

O VI 

O Vi 

VI 

41 

rH  O 

4J  iH 

•9  Vi 

UH  14 

o to 

•9  9. 

C4 

4) 

.o 

i-t  « 

9 VI 

41  o 

41  Vi 

VI  4) 

rH 

9 

a 

4)  (4 

•H  9 

rH 

43  9 

Vi 

00<vi 

73 

9 

P.I-H 

•o 

tH  (0 

00 

4)  9 

9 O 

00 

SB 

O 9 

41 

C4  V4 

VI  tH 

9 VI 

-rl 

9 

41 

U 9. 

9 v» 

MH  o 

9 MH 

•9  X 

Vl  00 

tH 

00 

*r«  O 

o 

a 9 

-rl 

9 

44 

to 

(3 

rH  4) 

*VI  *9 

S O 

00  UH 

4)  'rt 

U 

a 

5P  2 

<4-1 

O 

VI  U 

9 

43  44 

O 

3 

9 8 

8 *vi 

VI 

tH  VI 

VI  u 

rH 

73 

•r< 

O 4) 

00  14 

C4  41 

44  U 

o 

9 8 

V4 

9 M 

10 

U 41 

UH  73 

UH 

rH 

9 O 

t|H  4) 

•H 

00  9 

O 9 

O 

O 

C9 

•O  V4 

> 

9 O 

9 to 

•9  9 

41 

Vl 

4»  -H 

O 00 

•H  O 

O 

41  73 

4) 

9 

u 

to  ID 

(D  V4 

44 

73  O 

Vl  9 

Vl 

u 

o la 

<4  O 

14 

O *9 

41  Vi 

9 rH 

9 

u 

(4  M 

.2  rH 

VI  o 

O rH 

10  41 

rH  9 

rH 

9 

P.  O 

(4  cv 

VI 

•9  9 

10  VI 

hH  41 

tH 

Vl 

8 o 

4)  K 

4>  O 

9 O 

T*  9 

14  Vl 

(4 

VI 

M T3 

41 

>->  4J 

33  O 

S -H 

(Vl  Q, 

(u 

10 

• 

• 

• 

• 

rH 

CM 

<n 

SO 

155 


SD72-SA-0054-3 


Catastrophic  explosion  of  a module  on  the  modular  structure  could  possibly 
destroy  the  entire  configuration.  Explosion  relates  to  a gas  generator 
or  heat  exchanger  failure. 
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Table  6. 6. 4-6  Safety  Consideration  for  Evaluating 
Propellant  Logistic  Element 
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Table  6. 6. 4-7  Safety  Consideration  for  Evaluating 
Propellant  Logistic  Elements 


Table  6. 6. 4-8  Safety  Consideration  for  Evaluating 
Propellant  Logistic  Elements 
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6.7  SAFETY  EVALUATION  OF  ORBITER  TO  ORBITER  PROPELLANT  TRANSFER 

6.7.1  Introduction 

It  can  be  postulated  during  the  life  of  the  orbital  logistics  operation, 
the  prime  delivery  element  (Orblter)  may,  through  an  extended  mission 
requirement  or  other  propellant  depletion  causes,  deplete  Its  RCS  or  OMS 
propellants  to  the  point  that  replenishment  of  Its  propellant  supply  Is 
necessary  before  de-orblt  Is  attempted.  The  objective  Is  to  evaluate 
conceptual  methods  for  replenishment  of  propellants  to  the  Orblter,  from 
a system  safety  viewpoint.  For  purposes  of  this  discussion,  the  NR-176A 
Model  of  the  Orblter  Is  used  as  a baseline  configuration. 

6.7.2  Sunmiary  of  Results 

The  safety  evaluation  Investigated  three,  approaches  that  were  potential 
candidates.  No  safety  preference  was  given  as  to  do  so  would  be  premature 
In  light  of  present  Orblter  concept  considerations.  When  the  design  concept 
Is  more  firm,  additional  Investigation  would  be  required  on  the  configuration 
If  this  capability  Is  to  be  a requirement. 

6.7.3  Discussion  of  Candidate  Concepts 

For  purposes  of  this  discussion  the  NR-176A  Model  of  the  Orblter  Is 
used  as  a baseline  configuration. 

The  -176A  Model  Is  configured  with  the  RCS  package  attached  at  the  wing 
tips  and  at  the  top  of  the  vertical  stabilizer.  The  OMS  Is  faired  Into  the 
aft  section  of  the  fuselage  at  the  base  of  the  vertical  stabilizer.  Both 
the  RCS  and  OMS  packages  are  self  contained  and  use  helium  pressurant  to 
effect  propellant  expulsion  by  use  of  metal  bellows  In  the  propellant  tanks. 
Propellants  are  different  between  systems  with  the  RCS  using  a monopropellant 
and  the  OMS  using  hypergollc  propellants.  Both  the  RCS  and  OMS  packages  are 
rigidly  attached  to  the  structure  such  that  It  would  be  Impractical  to  try 
to  effect  their  detachment  by  EVA.  The  electrical  leads  and  connections 
to  the  packages  do  not  lend  themselves  to  disconnection  by  QD  or  EVA. 

While  many  systems  could  be  developed  which  could  accomplish  propellant 
transfer  for  the  RCS  and  OMS,  three  approaches  appear  to  reduce  EVA 
requirements  and  provide  the  necessary  capability  for  propellant  transfer. 
These  are  as  follows. 

a.  Provide  preplumbed  lines  Into  the  system  from  each  RCS  and 
OMS  tank  propellant  supply  manifold  to  line  Interconnect 
fixtures  In  the  cargo  bay  which  could  mate  with  propellant 
tank  kits  provided  for  the  specific  transfer  operation  and 
could  be  secured  In  the  cargo  bay  after  transfer  by 
manipulators.  See  Figure  6. 7. 3-1. 
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Figure  6.7.3*-l  Orblter  to  Orblter  Transfer  Concept  A 
(Pre-  Plumbed  System) 


b.  Utilize  the  airborne  half  of  the  ground  fill  line  attach  points 
to  the  RCS  or  QMS  tanks  and,  through  use  of  long  flex  lines 
attached  to  the  manipulator  and  compatible  fittings,  connect  the 
lines  for  transfer  of  propellants  from  tank  kits  in  the  logistic 
supply  orblter  cargo  bay.  See  Figure  6. 7. 3-2. 
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c.  Provide  the  capability  for  quick  release  and  attachment  of  the  RCS 
and  OMS  pods  such  that  package  detachment  and  replacement  with  a 
fully  fueled  package  can  be  effected  using  manipulators.  See 
Figure  6. 7. 3-3. 


Figure  6. 7. 3-3  Orblter  to  Orblter  Transfer  Concept  C 
(Removable  OMS  & RCS  Packages) 


6.7.4  Safety  Evaluation  of  Concepts 

The  Orbiter-to-Orbiter  propellant  transfer  was  evaluated  for  involved 
operations  during  the  transfer.  The  evaluation  data  is  contained  in  Table 
6. 7. 4-1. 


From  a review  of  the  three  approaches  no  safety  preference  was  made. 
Approach  two  seems  to  eliminate  many  operations  where  leakage  could  occur 
and  uses  systems  which  are  existing.  The  use  of  long  flex  lines  with 
problems  of  attachment,  heating  and  stowing  could  offset  these  advantages. 
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Orbiter  to  Orblter  Propellant  Transfer 
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Table  6. 7. 4-1 

Orblter  to  Orblter  Propellant  Transfer 
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Orblter  to  Orblter  Propellant  Transfer 
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7.0  CONCLUSIONS 

The  System  Safety  Analysis  of  In  Space  Propellant  Logistics  Operations 
was  performed  to  determine  the  recommended  safety  guidelines  for  implementing 
these  operations.  Several  major  conclusions  have  been  formulated  relative 
to  these  operations. 

a.  In  space  propellant  logistics  operations  can  be  performed  safely 
for  both  the  with  storage  and  without  storage  concepts. 

b.  Propellant  delivery  direct  to  a user  without  storage  Is  a safer 
concept  than  with  storage  because  of  the  reduction  of  the  number 
of  critical  operations. 

c.  Non-deployment  of  the  propellant  tank  module  from  the  orblter  cargo 
bay  Is  the  recommended  safety  concept  for  propellant  transfer  to 
tug-type  vehicles. 

d.  Deployment  of  a propellant  logistic  element  from  the  orblter  cargo 
bay  for  soft  docking  to  another  element  should  be  accomplished  with 

a combination  of  the  manipulator  and  rotational  deployment  mechanisms. 

e.  Modular  transfer  of  propellants  to  modular  users  Is  a recommended 
concept. 

f.  Rotational  and  linear  accelerations  during  fluid  transfer  are  both 
safe  concepts  for  propellant  settling. 

g.  Fluid  transfer  from  a propellant  tank  module  to  a small  (tug  type) 
vehicle  may  be  performed  safely  with  the  orblter  attached  or  the 
orblter  not  attached. 

h.  Fluid  transfer  from  a propellant  tank  module  to  a large  (LSF,  CIS 

or  RNS)  vehicle  should  be  accomplished  with  the  orblter  not  attached. 

1.  The  effect  of  disturbances  resulting  from  fluid  Instability  and 

their  effect  on  vehicle  control  systems  during  propellant  logistics 
operations  Is  a potential  residual  hazard. 

j.  Large  propellant  leaks  In  space  which  solidify  In  the  cargo  bay  will 
sublime  In  a few  hours  If  the  bay  Is  oriented  for  maximum  heating. 

k.  Propellant  leakage  or  venting  In  the  cargo  bay  during  deorbit 
operations  Is  a potential  residual  hazard. 
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Propellant  logistics  elements  can  be  returned  to  earth  safely  in 
the  orblter  cargo  bay  if  propellant  leakage  is  within  specification 
and  if  the  pressure  relief  capability  provided  for  the  tanks  allows 
for  a rapid  change  of  the  liquid  residual  propellants  to  a gas 
without  exceeding  acceptable  tank  pressures. 

Uniformity  and  commonality  of  interfaces  for  docking,  stowing  and 
transfer  operations  between  interfacing  propellant  logistics 
elements  (including  orblter)  is  required. 
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8.0  ADDITIONAL  STUDY  EFFORT  RECOMMENDED 

System  Safety  analyses  have  identified  areas  requiring  efforts  which 
are  beyond  the  scope  of  the  study.  Because  of  the  potential  hazards  associ- 
ated with  these  areas,  resolution  should  be  considered  prior  to  space  shuttle/ 
propellant  logistic  element  integration. 

8.1  DYNAMIC  CONTROL  OF  VARIOUS  MATED  CONFIGURATIONS 

Disturbances  such  as  sloshing,  impact,  fluid  surface' distortion,  are 
present  in -propellant  logistic  operations.  The  effect  of  these  disturbances 
acting  on  various  elements  or  combinations  of  docked  elements,  cannot  be 
fully  investigated  without  study  of  the  coupling  effects  of  the  elements' 
structural  dynamics  and  RCS  action  when  influenced  by  the  disturbances  in 
zero  g.  A study  is  required  to  provide  visibility  on  the  sensitivity  of 
these  variables  during  critical  propellant  logistic  operations. 

8.2  ZERO  "G"  LEAK  DETECTION 

Zero  g leak  detection  devices  and  sensing  techniques  should  be 
developed  for  use  with  orbital  propellant  logistic  operations. 

8.3  LOW  THRUST  RCS 

A long  life  low  thrust  RCS  should  be  developed  for  safe  linear  accelera- 
tion propellant  settling  operations. 

8.4  ZERO  "G"  PROPELLANT  GAUGING 

Random  orientation  of  propellants  (LH2  SH2,  LO2)  in  zero  g requires 
study  of  quantity  gauging  techniques  for  propellant  logistic  tanks  in  orbital 
use.  The  potential  loss  of  tank  thermal  protective  environment  causing  hot 
spots  makes  this  measurement  a critical  item  for  earth  return  of  the  tank 
module  in  the  orblter  cargo  bay. 

8.5  VAPORIZATION  OF  RESIDUAL  PROPELLANTS 

Sloshing  of  residual  propellants  against  a warm  wall  of  a tank  in  the 
cargo  bay  during  deorblt  and  landing  could  cause  the  fluid  to  flash  to  a 
vapor.  A transient  analysis  which  considers  the  parameters  Influencing 
residual  propellants  in  the  tank  should  be  conducted.  The  investigation 
should  provide  design  considerations  relating  to  vent  sizing,  tank  volumes 
and  residual  propellant  quantities,  as  a function  of  heat  Inputs  anticipated 
for  various  Insulation  efficiencies. 
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APPENDIX  A 

REPRESENTATIVE  ORBITAL  PROPELLANT  LOGISTIC  OPERATIONS 
AND  FUNCTIONAL  FLOW  DIAGRAMS 


INTRODUCTION 

Operations  and  functions  of  the  Representative  Orbital  Propellant 
Logistic  concept  were  developed  for  the  concept  baseline  initially  and  as 
variations  by  the  tug  sharing  delivery  functions  was  Introduced  the  delta 
operations  and  functions  were  added.  These  delta  operations  and  functions 
are  coded  with  a letter  A after  the  applicable  functional  flow  diagram 
number. 

With  the  Introduction  of  the  ESS  variation  as  another  concept  for 
delivery  of  large  propellant  tanks  to  orbit  in  support  of  CIS/RNS,  the 
functions  were  described  but  the  operations  were  used  as  presented  in  the  NR 
Phase  B Final  Report  of  the  ESS/Reusable  Space  Shuttle  Booster  under  Contract 
NAS9-10960  and  are  not  re-written  in  this  report.  The  functional  flow  dia- 
grams for  the  ESS  variation  are  coded  by  a letter  B. 

These  operations  with  functional  flow  diagrams  were  used  in  supporting 
the  FMEA's  and  hazard  analyses  conducted  during  the  study. 

Operations 

The  booster  Is  not  considered  in  its  role,  as  a part  of  this  safety 
study  as  only  orbital  operations  are  addressed i except  where  any  unique 
hazard  may  be  identified  through  Interface  with  the  handling,  transfer, 
transport  or  storage  of  orbital  propellant  elements. 

Where  there  Is  a possibility  of  major  impact  to  the  propellant  delivery 
elements,  both  booster  and  orblter  operations  are  Included  and  may  reflect 
some  redundancy  with  other  studies. 

1.  FFD  2.0  Perform  Assembly  and  Launch  to  Orbit 

The  general  functions  of  FFD  2.0,  associated  with  this  Safety  Study, 
start  with  the  attalnmendl'9f>>stsndby  status. 

Attainment  of  standby  status  includes  all  requirements  necessary  to 
place  the  space  shuttle  and  propellant  module  in  a mode  that  will 
permit  the  start  of  launch  countdown.  All  vehicle  systems  will  be 
brought  to  a flight-ready  configuration  and  maintained  in  this  mode. 
Control  of  access  to  the  launch  pad  area  and  vehicle  will  be 
established.  Status  monitoring  will  be  via  the  data  bus  and  support 
equipment. 
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Selected  vehicle  subsystems  will  be  powered  down  to  permit  electri- 
cal checkout  and  subsequent  connection  of  ordnance  Interface  connec- 
tors. 

Support  equipment  and  propellant  storage  areas  will  be  prepared  and 
brought  to  a launch  ready  configuration.  Propellant  transfer  sys- 
tems for  shuttle  and  propellant  module,  pressurant  systems  and 
equipment  valve  statuslng  will  be  placed  In  a launch  ready  configur- 
ation. 

After  ordnance  connection,  servicing  of  JP  and  LH2  tanks  and  line 
conditioning,  the  LH2  system  for  the  shuttle  and  propellant  module 
or  payload  will  be  monitored  until  launch. 

Rigid  pad  and  vehicle  control  Is  Implemented  prior  to  these  opera- 
tions and  maintained  because  of  the  hazardous  nature  of  the  shuttle 
and  module  propellant  tank  atmospheres. 

Perishable  Items,  payload  and  hazardous  cargo  will  be  loaded  (food, 
servicing  payload  nitrogen  tanks,  and  storage  of  UDMH  or  N2O4  con- 
tainers) and  placed  In  a standby  mode. 

During  this  period,  should  a decision  be  made  to  change  the  payload. 
Interfaces  will  be  disconnected  to  prevent  interference  with  the 
payload  handling  device  and  payload  transfer  device,  except  those 
necessary  to  purge  and  Inert  the  propellant  module  tank  of  gaseous 
hydrogen.  Once  Inerted  the  remaining  disconnects  are  removed,  the 
payload  Is  extracted  from  the  cargo  bay  and  lowered  to  a waiting 
payload  transporter  for  return  to  the  payload  handling  facility. 
Emplacement  of  the  new  payload  will  require  the  same  basic  devices 
and  a post  checkout  will  be  conducted  via  the  Data  and  Control 
Management  System  (DCM)  to  verify  compatibility  of  the  new  payload 
and  orblter  Interfaces.  Update  of  mission  software  Is  made  to  up- 
date the  flight  program  In  the  DCM  and  verify  same. 

Perform  Launch  Operations 

Launch  operations  begin  with  propellant  loading.  The  launch  pad 
area  will  be  under  access  control  and  cleared  during  this  period. 

An  automated  system  capable  of  contingency  pause  and  revert  capa- 
bility will  accomplish  chllldown  of  transfer  lines  and  tankage  to 
the  shuttle,  propellant  module  or  other  payload  propulsive  stage, 
venting,  transfer  of  propellants,  replenishment  and  propellant 
loading  termination. 

After  chllldown,  simultaneous  loading  of  liquid  oxygen  (LO2)  and 
liquid  hydrogen  (LH2)  Into  the  booster,  orblter  and  payload  will 
begin.  The  first  phase  of  loading  will  be  at  a low  rate  of  flow, 
followed  by  a high  rate  of  flow.  Completion  of  the  propellant 
loading  Is  accomplished  by  another  low  flow  rate  sequence. 
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Airborne  level-sensing  transducers  feeding  the  ground  computer 
system  and  ground  transducers  will  control  the  automated  loading 
sequence.  Remote  control  and  display  capability  will  monitor  pro- 
pellant loading  throughout  the  countdown,. 

As  soon  as  single  phase  conditions  are  achieved,  the  fuel  cells 
will  be  started. 

Topping  of  the  propellant  tanks  of  the  shuttle  and  propellant  pay- 
load  will  replenish  propellants  lost  in  boiloff,  at  a low  flow 
rate.  The  topping  mode  is  continued  throughout  crew  and  passenger 
loading  until  time  for  pressurization.  Termination  of  replenishment 
is  an  integral  function  of  the  automated  terminal  countdown. 

The  launch  vehicles  and  launch  pad  service  tower  will  incorporate 
emergency  egress  capabilities  for  the  flight  crews,  passengers,  and 
other  service  personnel  during  launch  operations. 

In  addition,  the  launch  facility  will  provide  personnel  saflng 
areas  to  protect  the  crew,  passengers,  tower  and  rescue  team  per- 
sonnel from  possible  hazards. 

Perform  Launch  Countdown  and  Launch 


The  flight  crew  will  conduct  the  launch  countdown  checklist  with 
each  function  on  the  countdown  checklist  performed  in  sequence. 

This  Includes  verifications  that  all  systems  are  configured  for 
launch,  confirmation  that  all  supporting  systems  are  in  a go  con- 
dition, starting  of  the  APU's  with  switching  to  vehicle  Internal 
power  once  stable  running  condition  is  reached.  The  checklist  also 
Includes  verifying  the  hydraulic  system  selected  actuators  and 
automatic  scan  of  the  airborne  systems  configuration  and  readiness 
to  launch. 

Range  safety  and  mission  clearance  to  launch  will  be  received  from 
the  Range  Safety  Officer  and  Mission  Director,  respectively. 

The  launch  program  will  be  initiated  by  the  flight  crew,  with  the 
launch  sequence  progressing  automatically  from  this  point  to  lift- 
off . 

Perform  Mated  Ascent 


Mated  ascent  begins  at  liftoff  of  the  space  shuttle  from  the  launch 
pad  and  continues  until  booster-orblter  separation  at  staging. 

At  liftoff,  the  booster  engine  thrust  vector  control  (TVC)  will 
activate  the  DCM,  and  the  auto-sequence  preprogrammed  maneuver  will 
be  commanded  to  provide  for  vertical  flight  to  about  100  feet  above 
the  tower.  Following  liftoff,  the  space  shuttle  vehicle  (SSV)  will 
be  aligned  for  vertical  flight  until  the  SSV  has  risen  to  approxi- 
mately 100  feet  above  the  tower. 
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The  roll  maneuver  will  be  Initiated  after  the  SSV  has  cleared  the 
launch  tower.  This  maneuver  is  performed  with  the  vehicle  vertical 
after  clearing  the  umbilical  tower  and  rotates  the  vehicle  to  enable 
a pure  pitch  maneuver  into  the  azimuth  required  for  the  desired 
initial  orbit  inclination. 

The  pitch  program  is  initiated  upon  completion  of  the  roll  maneuver. 

The  primary  functions  of  the  ascent  guidance  are  continuing  the 
pitch  program,  regulating  the  thrust  of  the  booster  engines,  and 
maintaining  the  roll  and  yaw  attitude  of  the  vehicle. 

Perform  Booster/Orbiter  Staging 

The  separation  subsystem  provides  a safe  separation  capability 
during  mated  ascent  for  both  normal  and  abort  initiated  conditions. 
Separation  of  the  orbiter  from  the  booster  is  performed  automatical- 
ly. 


The  automatic  sequence  of  the  booster  vehicle  staging  will  be 
initiated  when  the  propellant  depletion  system  provides  a discrete 
signal.  Sensors  installed  in  the  booster  oxidizer  tankage  system 
will  provide  the  primary  discrete  signals  to  initiate  the  sequence. 
The  LH2  tankage  sensors  will  provide  a backup  discrete  signal.  The 
output  of  the  sensor  excitation  and  monitor  circuitry  will  be  used 
by  the  DCM  to  initiate  the  staging  sequence. 

When  the  propellant  depletion  discrete  signal  is  issued  to  the  DCM 
in  both  the  orbiter  and  booster,  they  will  initiate  their  respective 
separation  sequences.  The  inertial  attitude  of  the  mated  vehicles 
is  maintained  by  the  booster  engine  TVC. 

The  hold-down  links  will  be  released  from  the  orbiter,  and  the 
separation  system  will  thrust  the  orbiter  off  the  booster. 

Achieve  Initial  Earth  Orbit 


Ascent  trajectory  parameters  are  computed  by  the  GN&C  subsystem  to 
provide  vehicle  attitude,  altitude,  and  velocity  information.  These 
ascent  parameters  are  computed  up  to  orbit  injection.  Main  engine 
TVC  commands  are  generated  to  maintain  the  required  trajectory  and 
achieve  the  correct  orbit  injection  conditions.  If  one  engine  fails, 
the  ACPS  provides  roll  control  while  the  remaining  engine  controls 
the  vehicle  pitch  and  yaw. 

The  orbiter  main  engines  will  operate  during  the  ascent  trajectory 
at  the  nominal  power  level  (NFL)  until  an  axial  acceleration  of 
3g's  is  reached. 

Commands  from  the  GN&C  subsystem  to  the  engine  control  unit  (ECU) 
will  reduce  thrust  to  compensate  for  depleted  propellants  and  main- 
tain axial  acceleration  until  engine  cutoff.  The  ECU  maintains  the 
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engine  thrust  and  mixture  ratio  constant  at  the  command  setting 
throughout  engine  operation.  The  thrust  vector  can  be  controlled 
over  a range  of  gimbal  angles  in  both  pitch  and  yaw  modes  by  the 
main  propulsion  gimbal  actuation  system. 

Injection  maneuvers  include  engine  cutoff  which  will  be  initiated 
by  a signal  from  the  GN&C  subsystem  when  the  proper  velocity  is 
reached.  Immediately  after  the  main  engine  shuts  down,  the  LO2  and 
LH2  prevalves  will  close.  With  the  engine  main  valves  closed  a 
double  seal  is  provided  against  tank  leakage  through  the  engine. 
Residual  propellant  bolloff  will  be  relieved  overboard  through  the 
on-orbit  vent  valves  (33-35  psla)  the  first  day(s)  in  orbit.  When 
tank  conditions  indicate  bolloff  is  complete,  the  vent  Isolation 
valves  will  be  closed  to  minimize  leakage  for  the  remainder  of  the 
mission.  Propellant  tank  module  venting  is  relieved  overboard.  A 
minimum  positive  tank  pressure  will  be  required  to  assure  structur- 
al integrity  of  any  propellant  tank  in  the  orblter  or  returned  to 
earth  in  the  cargo  bay. 

The  cargo  bay  doors  will  be  opened  to  expose  the  space  radiators 
and  prevent  buildup  of  hazardous  gasses  due  to  propellant  tank 
module  venting. 

2.  FFD  3.0  Perform  Orbital  Buildup  Operations 

The  Large  Storage  Facility  (LSF)  is  in  orbit  with  limited  attitude 
control  correction  capability  and  is  otherwise  passive  until  addi- 
tional components  are  deployed  by  the  orblter  and  docked. 

Orbital  deployment  of  the  equipment  module  will  be  via  the  space 
shuttle.  After  attainment  of  orbit  by  the  orblter  and  relative 
orientation,  rendezvous  operations  will  bring  the  orblter  in  close 
proximity  to  the  LSF  docking  ring.  The  equipment  module  will  be 
deployed  from  the  cargo  bay  and  docked  with  the  LSF.  After  docking 
the  physical  Interface  will  be  visually  checked  from  the  orblter  by 
the  crew,  and  simple  verification  tests  will  be  performed.  The 
orblter  will  then  separate  and  the  crew  will  perform  a visual  in- 
spection from  within  the  orblter  of  the  external  area  of  the  LSF. 

The  orblter  will  then  back  off  to  a safe  standoff  distance. 

Deployment  of  the  LOX  module  and  activation  crew  will  be  initiated 
after  equipment  module  emplacement. 

After  initial  rendezvous  and  docking  of  the  LOX  module  to  the  LSF, 
the  orblter  crew  will  verify  the  external  systems  mating  by  visual 
inspection  through  the  orblter  observation  ports.  This  will  be  done 
while  docked  to  the  LOX  module,  during  orblter  detach  operations 
from  the  LOX  module,  and  while  in  transit  to  the  equipment  module 
for  re-docking.  The  onboard  checkout  system  will  be  verified 
operational  by  the  Ground  Mission  Control  and  the  orblter  crew  will 
enter  the  equipment  module.  The  crew,  after  verifying  the  life 
support  system  operation,  will  perform  an  internal  visual  Inspection 
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of  the  crew  compartment,  the  docking  ring  and  the  LOX  module  and 
all  Interfaces  between  these  modules.  Recalibration  and  data 
verification  will  be  performed  as  necessary  from  LSF  system  monitor- 
ing performed  by  Mission  Control  during  the  foregoing  initial  de- 
ployment period,  the  Onboard  Checkout  Equipment  (OBE)  operation 
and  the  crew  members'  observances.  The  power  supply  will  be  re- 
charged and  replaced  as  required.  EVA  inspection  of  the  complete 
vehicle  will  be  performed  only  as  a last  resort  as  required  by 
determination  of  the  previous  inspection  of  the  orbiter.  This 
inspection  and  checkout  will  lead  to  an  OK  for  first  user  docking. 
The  crew  re-enters  the  orbiter,  the  orbiter  then  detaches  from  the 
equipment  module  and  maneuvers  to  a safe  distance  for  first  docking 
observation. 

FED  3.0A  Perform  Transfer  of  Mission  Payload  Delivery  Function 

During  this  operation  the  interaction  of  the  orbiter  and  tug  in 
support  of  payload/module  delivery  is  operationally  described.  The 
orbiter  and  tug  interface  at  the  100  nm  orbit  and  have  effected 
rendezvous.  The  orbiter  configuration  is  readied  for  deployment 
operations  which  can  involve  deployment  of  a propellant  module,  the 
reusable  tug  or  payload  propulsive  stage  and  satellite.  The  orbiter 
may  transfer  Orbit  Maneuvering  System  (OMS)  propellant  to  the  de- 
ployed reusable  tug  for  the  initial  mission  to  rendezvous  with  the 
LSP  or  through  a second  orbiter  flight  bring  a propellant  tank 
module  to  the  space  based  tug,  dock,  and  transfer  propellant  direct 
by  rotational  or  linear  acceleration  at  100  nm  for  initiation  of  the 
tug's  useful  operation.  In  the  case  of  OMS  transfer,  the  transfer 
of  propellants  is  made  through  a transfer  system  contained  within 
the  orbiter,  interfacing  at  disconnects  in  the  cargo  bay.  Once  the 
space  based  tug  is  loaded  with  propellants,  the  vehicle  is  deployed 
by  orbiter  manipulators  to  space.  Other  payload  propulsive  stages 
with  their  payload  are  also  deployed  by  the  orbiter  manipulators. 
Upon  deployment  the  orbiter  translates  and  separates  from  the 
delivery  vehicle  which  could  be  the  space  based  tug,  FW-4S,  Agena 
or  Centaur.  The  payload  propulsive  stages  with  satellite  are  then 
launched  to  their  respective  orbits.  After  the  initial  deployment 
of  reusable  tugs,  the  operation  becomes  one  of  docking  the  propel- 
lant tank  module  to  the  tug  and  transferring  the  empty  propellant 
tank  module  returned  by  the  tug  to  the  orbiter  cargo  bay. 

Upon  docking  the  propellant  tank  module  to  the  space  based  tug,  the 
orbiter  separates  from  the  tug/propellant  tank  configuration  by 
translation  and  maintains  a standoff  distance  from  the  tug  while 
the  tug  and  module  are  prepared  for  automatic  remote  injection 
operations  to  a 262  nm  orbit  and  rendezvous  with  a target  which 
would  be  a LSF,  to  conduct  propellant  transfer  operations. 
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4 . FFD  4.0  Perform  Propellant  Transfer  Operation 

Performance  of  this  function  starts  with  orbit  and  phase  change 
through  possible  use  of  two  types  of  phasing  - natural  or  catch-up 
phasing  and  high  phasing  or  catch-back.  The  orbit  and  phase  chang- 
ing will  be  accomplished  by  OMS  burn. 

The  actual  rendezvous  function  starts  with  the  terminal  phase 
Initiation  (TPI)  burn  of  the  OMS  which  puts  the  orblter  Into  an 
orbit  from  which  terminal  phase  finalization  (TPF)  maneuvers  occur. 
The  orblter  shall  be  self-targeting  and  range  and  range  rate  must 
be  obtained  by  the  orblter  Itself  for  TPI  and  TPF.  The  rendezvous 
maneuver  operation  Is  assumed  to  position  the  orblter  within  1000 
feet  of  the  LSF.  The  LSF  Is  a passive  cooperative  target. 

The  orblter  will  deploy  the  propellant  module  by  rotation  about  the 
y axis  or  articulation  out  of  the  cargo  bay  by  use  of  manipulators. 
While  both  could  accomplish  the  deployment  operation  the  manipulator 
concept  of  the  baseline  system  Is  used  for  purposes  of  this  study. 

The  propellant  tank  module  Is  attached  to  the  manipulator  system 
and  with  the  use  of  aids  (TV,  floodlights)  the  module  Is  moved  out 
of  the  cargo  bay  and  oriented  Into  a docking  position.  Movement  by 
translation  of  the  orblter  to  the  LSF  Is  accomplished  to  within  the 
effective  distance  of  the  manipulator  arm  at  low  closing  velocities 
of  0.5  feet/sec.  The  LSF  has  been  stabilized  and  aligned  for  dock- 
ing attitude  with  communication  and  control  from  Mission  Control 
while  surveillance  will  be  provided  by  the  orblter.  Docking  will 
be  under  control  of  the  orblter  crew. 

The  propellant  tank  module  Is  aligned  and  extended  by  manipulators 
to  dock  with  the  LSF  at  the  docking  port  outboard  on  the  LOX  tank 
module.  The  sequence  of  operation  Is  alignment  and  centering,  con- 
tact of  cones  between  active  and  passive  docking  assemblies,  capture 
and  latching,  pull  down  and  rlgldlzlng  by  12  separate  docking 
latches,  automatically  engaged. 

The  manipulators  are  disengaged  from  the  propellant  tank  module  and 
the  orblter  translates  away  from  the  LSF  to  a standby  position. 

The  orblter  crew  provides  surveillance  while  Mission  Control  commands 
the  propellant  transfer  operation  sequence  which  covers  retraction 
of  the  line  Interconnect  fixture  meteoroid  shield,  rlgldlzlng,  rack 
extension  and  engagement  of  electrical  connection  probes,  extension 
of  propellant  and  system  lines  and  transfer  preparation  and  checkout 
of  equipment  module  and  LSF  systems  In  the  remote  automatic  mode. 
Propellant  tank  chllldown  Is  followed  by  actuation  of  the  LSF  ACS 
to  Impart  a very  low  spin  rate  to  produce  an  artificial  "G"  (about 
•OOlg)  In  the  LSF  configuration  for  propellant  settling.  Chilling 
and  pressurization  are  accomplished  followed  by  propellant  fast 
fill  Initially,  followed  by  throttled  fill  during  the  latter  trans- 
fer operation  period.  When  propellant  transfer  Is  complete,  trans- 
fer lines  are  drained  of  liquids  and  the  system  Is  depressurized. 

The  ACS  Is  commanded  to  Initiate  deceleration  which  upon  accompllsh- 


- 176  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


ment  will  return  the  LSF  configuration  to  a stabilized  mode. 

The  LSF  configuration  Is  given  a post-transfer  checkout  and  secured 
by  Mission  Control  while  surveillance  Is  provided  by  the  orblter 
crew.  Once  secured,  the  propellant  transfer  and  system  lines  of 
the  line  Interconnect  fixture  are  retracted,  the  electrical  connec- 
tors are  disengaged  and  the  Index  probes  are  derlgldlzed  and  with- 
drawn/retracted. The  line  Interconnect  fixture  meteoroid  shield 
Is  extended  to  cover  the  fixture  and  the  undocking  of  the  propellant 
tank  module  can  commence.  A similar  transfer  approach  between  the 
LSF  and  user  Is  employed  except  the  user  docks  Instead  of  the  pro- 
pellant tank  module,  and  at  a user  port  location. 

The  orblter  translates  from  Its  standby  position  to  standoff,  with 
the  empty  propellant  tank  module,  while  the  manipulators  are 
attached  to  the  module  and  undocking  Is  accomplished.  The  orblter 
then  translates  away  from  the  LSF  and  returns  the  empty  propellant 
tank  module  to  the  orblter  cargo  bay. 

5.  FFD  4.0A  Perform  Propellant  Transfer  Operation  (Tug) 

Performance  of  this  function  starts  with  orbit  and  phase  change 
through  possible  use  of  two  types  of  phasing:  natural  or  catch-up 

phasing  and  high  phasing  or  catch-back.  The  orbit  and  phase 
changing  will  be  accomplished  by  tug  main  engines  burn.  Since  the 
entire  operation  Is  accomplished  In  the  automatic  mode,  communica- 
tion and  control  between  tug  and  LSF  Is  exercised  by  Mission  Control. 

The  actual  rendezvous  function  starts  with  the  terminal  phase 
Initiation  burn  of  the  main  engines  which  puts  the  space  based  tug 
with  propellant  tank  module  payload  Into  an  orbit  from  which  ter-  . 
mlnal  phase  finalization  maneuvers  occur.  The  tug  under  Mission 
Control  surveillance  will  accomplish  the  finalization  burn  and 
proceed  to  hard  dock  the  propellant  tank  module.  This  docking  con- 
cept for  the  tug  employes  hard  docking  with  Integrated  mechanical 
restraint  and  access  system,  contains  automatic  docking  features 
with  radar,  sensors,  guidance  and  remote  control  as  the  primary 
mode  with  manual  capability  using  radar,  sensors  and  visual  cues 
as  a backup  mode.  The  docking  system  Is  a neuter  ring  and  cone 
assembly.  The  tug  will  assume  the  active  role  In  docking  operations 
with  the  LSF. 

There  are  concepts  of  the  tug  which  Include  a crew  module  In  the 
tug  configuration.  For  purposes  of  this  study  they  are  addressed 
lightly  only  to  Indicate  representative  areas  of  concern,  but 
otherwise  the  function  remains  unmanned. 

The  tug  undocks  from  the  propellant  tank  module  and  maneuvers  to  a 
user  port  on  the  LSF  where  It  hard  docks  for  propellant  tank  re- 
plenishment, under  the  operation  of  Mission  Control.  The  docking 
sequence  for  both  the  propellant  tank  module  and  the  tug  are  similar 
and  Involve  alignment  and  centering,  contact  of  cones  between  active 
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and  passive  docking  assemblies,  capture  and  latching,  pull  dovm  and 
rlgldlzlng  by  12  separate  docking  latches,  automatically  engaged. 

The  sequence  for  propellant  transfer  from  the  propellant  tank 
module  Into  the  LSF  and  from  the  LSF  to  the  tug  are  now  Initiated 
and  controlled  by  Mission  Control.  The  sequence  starts  with  re- 
traction of  the  line  Interconnect  fixture  meteoroid  shield,  rack 
extension  and  engagement  of  Indexing  probes,  rlgldlzlng  the  fixture, 
engagement  of  electrical  connection  probes,  extension  of  propellant 
and  system  lines  and  transfer  preparation  and  checkout  of  equipment 
module  and  LSF  systems  In  the  remote  automatic  mode.  Propellant 
tank  chllldown  Is  followed  by  activation  of  the  LSF  ACS  to  Impart  a 
very  low  spin  rate  to  produce  an  artificial  "g"  (about  .OOlg)  In  the 
LSF  configuration  for  propellant  settling.  Chilling  and  pressuriza- 
tion are  accomplished  followed  by  propellant  fast  fill  Initially 
followed  by  throttled  fill  during  the  latter  transfer  operation 
period.  When  propellant  transfer  Is  complete,  transfer  lines  are 
drained  of  liquids  and  the  system  Is  depressurized.  The  ACS  Is 
commanded  to  Initiate  deceleration  which,  upon  accomplishment,  has 
returned  the  LSF  configuration  to  a stabilized  mode. 

The  LSF  configuration  Is  given  a post^transfer  checkout  and  secured 
by  Mission  Control.  Once  secured,  the  propellant  transfer  and 
system  lines  of  the  line  Interconnect  fixture  are  retracted,  the 
electrical  connectors  are  disengaged  and  the  Index  probes  are  de- 
rlgldlzed  and  withdrawn/retracted.  The  line  Interconnect  fixture 
meteoroid  shield  Is  extended  to  cover  the  fixture  and  the  undocking 
of  the  tug  can  commence. 

The  tug  Is  first  to  be  undocked  from  the  LSF,  translating  away  from 
the  LSF  user  port  and  maneuvering  Into  retrieval  position  with  the 
propellant  tank  module  where  It  docks  to  the  outboard  docking  port 
of  the  module  under  automatic  or  manual  override  control  from 
Mission  Control.  Mission  Control  then  commands  undocking  at  the 
forward  docking  sectlon/LOX  tank  module  Interface  and  the  tug  with 
empty  propellant  tank  module  Is  translated  away  from  the  LSF  to 
prepare  for  a transfer  orbit  Insertion.  Mission  Control,  coordinat- 
ing the  orblter  propellant  tank  module  re-supply  schedule,  programs 
the  tug/down  module  orientation  for  transfer  orbit  burn  execution 
and  deorblt  and  phasing  change  are  automatically  executed  by  the 
IMU  and  monitored  by  Mission  Control.  Terminal  phase  finalization 
burns  are  made  to  bring  the  tug  Into  a rendezvous  position  with  the 
orblter.  Standoff  from  the  orblter  Is  maintained  until  the  trans- 
fer of  mission  payload  delivery  functions  Is  again  Initiated  by  the 
orblter  In  an  Iterative  re-cycle  process. 

FFD  5.0  Perform  Maintenance  Operations 

Maintenance  operations  functions  will  require  support  from  the 
orblter  Involving  delivery  of  the  necessary  modules  containing 
maintenance  equipment  and  delivery  of  the  maintenance  crew.  The 
operations  start  with  Initiation  of  orbit  and  phase  change  as  Is 
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described  In  FFD  4.0.  The  maintenance  target  is  the  LSF  configura- 
tion, however  where  maintenance  on  propellant  systems  of  the  Space 
Station  is  required,  the  Space  Station  could  be  a rendezvous  target. 
For  this  study  the  Space  Station  has  been  indicated  in  the  function 
but  not  addressed  specifically.  The  orblter  shall  be  capable  of 
self  targeting  and  range  and  range  rate  data  will  be  obtained  by  the 
orblter  for  TPI  and  TPF  with  update  data  from  Mission  Control.  The 
rendezvous  maneuver  operation  is  assumed  to  position  the  orblter 
within  1000  feet  of  the  LSF  which  is  configured  with  the  equipment 
module  and  possibly  with  a user  vehicle  such  as  the  tug  or  CIS.  The 
orblter  docks  with  the  equipment  module  through  use  of  the  docking 
adaptor  and  off  loads  the  maintenance  crew  for  minor  maintenance 
operations.  The  LSF  ECLSS  is  activated  in  the  equipment  module  and 
maintenance  is  conducted  therein.  Upon  completion  of  the  mainten- 
ance, the  equipment  module  is  deactivated,  the  crew  removed,  doors 
and  hatches  sealed  and  the  orblter  readied  for  undocking.  Portable 
life  support  systems  are  used  as  required  In  these  operations. 

Where  major  maintenance  Is  to  be  accomplished  and  the  dwell  time  is 
anticipated  to  be  extensive,  equipment  and  crew  will  be  delivered  to 
the  LSF  and  stay  In  a separate  crew  module  which  Is  delivered  by  the 
orblter. 

The  crew  module  Is  deployed  by  manipulators  on  the  orblter  and 
translated  to  dock  at  a user  docking  port.  The  alternative  Is 
docking  the  crew  module  to  the  orblter  docking  adaptor  and  then 
dodking  at  the  user  port.  The  maintenance  crew  will  activate  the 
life  support  system  within  the  LSF  tunnels  and  equipment  module 
with  assistance  from  Mission  Control.  Upon  achieving  a suitable 
environment  within  the  LSF,  the  orblter  will  either  disengage  the 
manipulators  or  undock  from  the  crew  module  and  separate  to  a safe 
distance  and  station-keep.  Upon  completion  of  the  maintenance 
activity,  the  orblter  will  re-dock  with  the  crew  module  or  re- 
attach the  manipulators  to  the  crew  module  In  preparation  for  un- 
docking . 

Where  the  maintenance  activity  is  extended,  the  orblter  will  undock 
and  transfer  down  modules  such  as  the  propellant  tank  module  Into 
the  orblter  cargo  bay  and  proceed  to  ready  Itself  for  return  to 
earth.  The  crew  and  crew  module  would  be  retrieved  in  this  case  in 
a subsequent  orblter  operation. 

7 . FFD  6.0  Undock,  Stow  and  Deorblt/Land 

The  functional  diagram  Is  presented  for  Information  purposes,  how- 
ever the  propellant  logistic  operation  for  safety  study  purposes 
completes  with  the  securing  of  the  module  in  the  orblter  cargo  bay. 
This  function  starts  with  undocking  of  the  numerous  modules  or 
orblter  for  purposes  of  earth  return.  The  modules  are  emplaced  In 
the  cargo  bay  by  the  orblter  manipulators,  which  through  use  of 
manipulator  aids  are  guided  Into  the  orblter  cargo  bay  attach 
fittings  and  secured  thereto.  In  the  case  of  the  crew  module, 
stowage  is  such  that  the  personnel  transfer  port  provided  in  the 
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cargo  bay  forward  bulkhead  is  aligned  so  as  to  allow  engagement  of 
the  payload  mating  ring  with  the  extendable  personnel  transfer  port 
section.  This  allows  personnel  access  and  egress  to  the  payload  or 
orblter,  respectively. 

Automatic  provisions  are  assumed  for  connection  of  systems  critical 
to  the  system  being  secured  such  as  connection  of  vent  valves  to 
the  orblter  vent  system  or  pressurization  system  connection  for 
module  pressurization  maintenance.  EVA  Is  not  considered  for  routine 
operations,  however  In  emergency  operations  EVA  may  be  necessary. 

All  EVA  will  be  conducted  by  the  "buddy  system."  EVA  will  be  as  a 
"last  resort"  only,  for  propellant  logistic  operations. 

After  properly  stowing  the  down  cargo,  manipulators  and  configuring 
the  orblter  for  re-entry,  on-orblt  phasing  and  vehicle  systems  will 
be  monitored  by  Mission  Control  and  navigational  update  material 
will  be  supplied.  Retro  maneuvers  will  be  made  with  QMS  engine 
burn.  The  orblter  will  establish  and  maintain  desired  pre-entry 
conditions  and,  before  the  orblter  enters  at  approximately  400,000 
feet,  the  APU's  are  started,  air  breathing  engines  are  deployed. 
Ignited,  and  maintained  In  the  Idle  mode.  The  orblter  enters  the 
approach  window  at  approximately  10  nm  from  the  runway.  The 
orblter  landing  Is  made  at  approximately  165  knots,  braked  and 
taxied  to  the  saflng  area. 

FFD  7.0  Perform  Mission  Abort  Operations 

Pad  abort  (prelaunch)  mode  Is  confined  to  the  period  of  crew  and 
passenger  loading.  It  terminates  at  liftoff.  This  Includes  booster 
and  orblter  crew  and  passenger  egress,  engine  and  system  deactiva- 
tion, saflng  and  off  loading  of  propellants  and  return  to  standby 
status. 

Booster-orblter  mated  ascent  abort  Is  based  on  critical  failures 
requiring  early  separation.  After  early  staging,  the  booster  per- 
forms an  ascent  to  propellant  depletion  and  then  cruises  to  permit 
recovery  at  the  launch  site.  The  orblter  Is  boosted  In  a rocket- 
powered  cruise  mode  to  a preselected  landing  site.  For  early  separa- 
tion, launch  site  or  down  range  recovery  may  be  necessary. 

The  booster  post— separation  abort  mode  may  occur  during  booster 
cruise  or  during  landing  as  a result  of  primary  turbojet  engine 
failure.  The  booster  abort  mode  Is  to  perform  an  emergency  cruise 
to  an  alternate  site  and  land. 

Orblter  ascent  abort  Is  considered  for  two  conditions  which  are  non- 
crltlcal  and  critical  failures.  After  failure  level  Is  Identified, 
three  abort  options  are  available:  abort  to  orbit  and  complete  the 

mission,  abort  once  around  to  primary  landing  site,  or  abort  down 
range  when  CONUS  landing  sites  are  available.  Ground  control  will 
aid  the  orblter  crew  In  making  the  abort  decision  and  will  coordin- 
ate orblter  actions  with  Air  Traffic  Control  (ATC) , the  booster  and 
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the  landing  site. 

The  orblter  landing  abort  mode  Is  Its  one-tlme-go-around  capability 
or  emergency  landing  with  reduced  turbojet  thrust.  With  turbojet 
thrust  reduced,  emergency  landing  procedures  must  be  accomplished 
during  the  Initial  approach.  For  the  go-around,  a nominal  final 
approach  corridor  Is  required  before  a landing  Is  performed.  There 
Is  no  go-around  abort  mode  available  for  an  unpowered  orblter. 

Abort  from  orbit  Involves  the  critical  consideration  of  establishing 
and  maintaining  the  exact  position  of  the  orblter,  the  wait  time, 
and  availability  of  the  landing  site.  For  the  selected  landing 
site,  the  orblter  performs  deorblt  and  entry  maneuvers. 

If  abort  requirements  are  Immediate  re-entry,  the  ground  will 
coordinate  re-entry  plans  with  ATC  and  coordinate  rescue  plans. 

Where  the  abort  from  orbit  allows  the  vehicle  to  remain  In  orbit 
for  a certain  time  before  re-entry,  the  ground  will  assist  the 
orblter  In  deorblt  targeting  to  select  the  best  landing  site  for 
vehicle  and  crew  return. 

If  the  on-orblt  abort  precludes  re-entry,  the  ground  will  coordinate 
the  rescue  mission. 

9.  FFD  8.0  Perform  Emergency  Rescue  Operations 

Operations  for  rescue  of  crews  Involved  In  the  Orbital  Propellant 
Logistic  Operation  relate  to  those  needed  to  rescue  maintenance/ 
checkout  crews  during  LSF  buildup,  checkout  and  maintenance.  This 
may  Involve  rescue  from:  the  crew  module,  equipment  module,  LSF 

tunnel  area  between  the  crew  module  and  equipment  module,  or  rescue 
of  the  crew  from  a disabled  orblter  supporting  the  manned  operation. 
Each  of  these  cases  Involves  the  dispatch  of  the  orblter  to  dock 
with  the  modules  or  capture  the  modules  with  the  manipulators  and 
undock  the  module  containing  the  crews  to  be  rescued.  Where  the 
orblter  Is  not  disabled  and  Is  on  standby,  the  orblter  will  effect 
the  rescue.  Where -extended  work  Is  being  performed  and  the  orblter 
has  returned  to  earth,  dispatch  of  another  orblter  for  the  rescue 
mission  will  be  made  by  ground  control. 

10.  FFD  9.0  Deactivate  Propellant  Logistic  Element 

Operations  on  the  orblter  comprise  those  functions  and  activities 
beginning  with  termination  of  flight  operations  at  the  end  of 
landing  rollout  and  ending  at  orblter  readiness  for  premate  checkout. 

Major  tasks  accomplished  are  post-landing  saflng  and  securing 
operations,  hangar  operations,  storage  and  ground  system  maintenance. 
The  propellant  tank  module  saflng  Includes  propellant  system  drain- 
ing, purging  and  venting  containment  prior  to  removal  from  the  cargo 
bay.  Ordnance  systems  associated  with  the  module  docking  system. 


- 181  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


If  any,  will  be  safed,  and  upon  completion  of  the  orblter  safing 
process  the  module  will  be  removed  from  the  cargo  bay  and  re-cycled 
through  the  maintenance  process. 

Functional  Flow  Diagrams 

The  functional  flow  diagrams  for  the  above  operations  are  contained  in 
Figures  A-1  through  A-22.  The  functions  of  the  baseline  Representative 
Orbital  Propellant  Logistic  Operations  with  the  tug  variation  in  sharing 
delivery  functions  are  structured  together,  because  of  their  Integrated 
functions,  in  Figures  A-1  through  A-17. 

The  ESS  variation  delivering  propellants  to  the  CIS  direct  Involves 
different  operations  and  is  thus  not  structured  with  the  orbiter  tug  functions. 
The  functions  of  the  ESS  variation  are  contained  in  Figures  A-18  through  A-22. 
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Figure  A-1  Perform  Assembly  and  Launch  to  Orbit 
(Shuttle/Propellant  Module) 
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Figure  A-2  Attain  Standby  Status 
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Figure  A-3  Perform  Launch  Operations 
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Figure  A-4  Perform  Launch  Countdown 
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Figure  A-5  Perform  Mated  Ascent 
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Figure  A-7  Achieve  Initial  Earth  Orbit 


Space  Division 

North  American  Rockwell 


SD72-SA-0054-3 


Figure  A-9  Perform  Transfer  of  Mission  Payload  Delivery  Function 

(Tug/Centaur  GT/FW-4S/Agena/Centaur) 
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Figure  A-10  Perform  Propellant  Transfer  Operations 
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Figure  A-11  Perform  Propellant  Transfer  Operation 

(Space-Based  Tug) 
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Figure  A-12  Perform  Maintenance  Operations 
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Figure  A- 14  Perform  Mission  Abort  Operations 
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Figure  A-15  Perform  Orbiter  Pad  Abort 
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Figure  A-16  Perform  Orbiter  Mated  Ascent  Abort 
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Figure  A-17  Perform  Rescue  Mission 


Space  Division 

North  American  Rockwell 


- 200 


SD72-SA-0054-3 


Figure  A-18  Perform  Assembly  and  Launch  to  Orbit 

(Shuttle  Booster/ESS/Large  Propellant  Tank) 
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Figure  A-21  Undock  and  Deorbit/ Impact  (ESS/Large  Propellant  Tank) 
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Figure  A-22  Perform  Mission  Abort  Operations 
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APPENDIX  B 

FAILURE  MODE  AND  EFFECTS  ANALYSIS 

The  representative  orbital  propellant  logistic  operations  described  In 
the  previous,  section  with  conceptual  element  subsystems  and  Interfaces,  are 
analyzed  for  failure  mode  effects  as  they  relate  directly  to  System  Safety 
In  the  propellant  logistic  operation.  In  certain  cases  where  unique  or 
otherwise  accentuated  problems  could  Impact  the  propellant  logistic  opera- 
tions, they  are  also  Identified.  Conceptual  configurations  and  designs  were 
used  from  available  studies. 

1.  Correlation  of  FMEA  with  Functional  Flow  Diagrams 

The  association  between  the  function  and  failure  for  purposes  of 
continuity  are  structured  for  the  convenience  of  the  reader.  The 
FMEA  forms  contain  a FMEA  number  In  the  upper  right  hand  corner. 

This  number  Is  also  the  number  of  the  functional  flow  block  diagram 
(FFBD) . The  Reference  FFBD  In  the  first  column  on  the  left  Is  the 
Reference  FFBD  under  which  the  FFBD  Is  contained.  The  operational 
step  In  the  next  column  Is  that  function  occurring  In  the  FFBD 
number  and  Is  associated  specifically  with  the  mission  phase 
Indicated  In  the  upper  left  hand  corner. 

2.  Ground  Rules  and  Assumptions 

a.  The  orbiter  vehicle  Is  baselined  for  this  analysis  as  the  -161C 
Model  configuration  defined  In  the  NR  Phase  B Final  Report, 
SD71-114. 

b.  The  shuttle  booster  Is  assumed  not  to  have  an  interface  with  the 
propellant  logistic  elements  in  the  orbiter  cargo  bay. 

c.  Payload  propulsive  stages  which  are  stowed  in  the  orbiter  cargo 
bay  In  a propellant  loaded  condition  are  not  considered  propel- 
lant logistic  operations,  but  rather  delivery  cargo. 

d.  The  propellant  logistic  operation  Is  unmanned  and  fully  auto- 
mated, except  for  the  orbiter  element  and  where  orbital  mainten- 
ance operations  or  modular  replacement  of  components  on  the  LSF 
are  required . 

e.  No  single  malfunction  or  credible  combination  of  malfunctions 
and/or  accidents  shall  result  In  Injury  to  personnel  or  loss  of 
mission. 

f.  The  tug  has  an  ability  to  add  a crew  module  to  Its  capability 
In  support  of  LSF  maintenance.  If  required. 
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g.  Orbital  propellant  logistics  operations  involve  only  those 
operations  necessary  to  supply  the  user,  propellants  in  earth 
orbit. 

h.  For  purposes  of  this  representative  propellant  logistic  opera- 
tion the  assumption  is  made  that  any  of  the  individual  elements 
of  the  logistic  system  are  capable  of  docking  vd.th  any  other 
element  in  the  system  and  that  docking  indexing  of  these  ele- 
ments will  properly  align  the  line  Interconnect  fixture. 

1.  It  is  assumed  that  all  elements  of  the  logistic  system  requiring 
or  providing  propellant  fluid  transfer  will  be  configured  with 
a line  Interconnect  fixture  common  to  all  elements. 

3.  Orblter  Related  Subsystems  Used  in  FMEA 

The  basic  configuration  and  performance  of  the  shuttle  orblter  used 
in  this  study  is  shown  in  Figure  B-1.  It  has  been  defined  in  the 
NR  Phase  B Final  Report,  SD71-114. 

Payload  Handling  and  Docking 

The  functions  of  payload  and  propellant  tank  module  deployment, 
payload  and  propellant  tank  module  retrieval  and  docking  are  accom- 
plished through  the  use  of  a pair  of  manipulator  arm  assemblies. 

The  manipulator  arms  are  located  on  either  side  of  the  personnel- 
to-payload  access  tunnel  and  are  stowed  along  the  cargo  bay  to  pro- 
vide a clear  volume  for  the  payload  of  15  feet  diameter  by  60  feet 
long.  A cargo  specialist  station  is  located  in  the  personnel  access 
tunnel  with  visibility  provisions  for  line-of-sight  viewing  of  the 
manipulator  operation.  The  direct  vision  is  augmented  by  closed- 
circuit  TV  with  cameras  mounted  on  the  manipulator  arms  and  in  the 
cargo  bay  to  provide  visual  check  of  the  payload  stowage  latching 
and  unlatching.  Figure  B-2  shows  the  significant  features  of  the 
PHDS  (Payload  Handling  and  Docking  System) . 

The  total  PHDS  comprises  two  manipulator  arms,  a docking  adaptor, 
a manipulator  operator  station,  an  airlock  docking  port,  a payload 
retention  system  and  a closed-circuit  TV  system  to  augment  direct 
vision  capability  and  provide  visibility  for  close  tolerance 
operation  out  of  direct  view  from  the  cargo  specialist. 

Docking  is  to  be  accomplished  by  the  orblter  first  matching  orbit 
and  station-keeping  with  the  other  stabilized  body  at  a distance  of 
no  more  than  50  feet  and  not  less  than  25  feet.  The  docking  is  to 
be  accomplished  through  the  use  of  the  payload  handling  and  docking 
(PHDS)  system.  The  manipulator  arms  of  the  PHDS  are  used  to  first 
deploy  a docking  adaptor  (if  required)  and  then  to  attach  this 
adaptor  to  the  crew  or  equipment  module  or  target.  Just  prior  to 
physical  acquisition,  the  stabilization  systems  of  the  target  must 
be  deactivated.  The  manipulator  arms  are  then  used  to  draw  the 
two  bodies  together  to  a docked  configuration. 
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Figure  B-1  Shuttle  Orbiter 
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Down  payloads  such  as  the  tug,  to  be  retrieved,  are  so  designed  that 
their  stabilization  capabilities  fall  within  the  proper  limits. 

After  physical  acquisition  or  engagement  of  a detached  payload  by 
the  PHDS,  attitude  control  of  the  payload  ceases. 

The  PHDS  does  not  Intrude  into  the  15-foot  diameter  by  60-foot 
length  of  the  payload  volume.  The  PHDS  has  the  capability  of 
docking  the  orblter  to  any  of  the  passive  targets  and  transferring 
cargo  from  the  orblter  to  any  of  the  remaining  ports  on  the  LSF, 
or  from  the  passive  targets  to  the  orblter  cargo  bay.  Alignment 
characteristics  for  docking  operations  with  respect  to  the  orblter 's 
frame  of  reference  are  shoim  in  Figure  B-3. 

Removal  of  the  docking  hardware  in  whole  or  in  part  is  not  required 
in  order  to  facilitate  transfer  through  the  docking  port.  The 
docking  port  is  located  on  the  top  centerline  of  the  orblter  aft 
of  the  crew  and  passenger  compartment  and  is  externally  accessible 
at  all  times. 

The  PHDS  does  not  preclude  payload  eg  control  and  it  randomly  de- 
ploys and/or  retrieves  payloads.  It  may  be  released  from  the  orblter 
in  zero-g  if  necessary  to  allow  the  closure  of  the  cargo  bay  doors 
for  safety,  during  re-entry. 

Payload  retention  in  the  cargo  bay  is  a function  of  the  PHDS.  Pay- 
loads  can  be  attached  in  the  cargo  bay  or  at  the  airlock  docking 
port.  Structural  attachment  loads  between  the  payload  and  the  cargo 
bay  are  statically  determinant. 

Manipulator  Arms  - Two  manipulator  arms  are  used  to:  provide 

stability  in  the  removal,  deployment,  and  retrieval  of  payloads 
that  may  vary  in  mass  distribution;  provide  additional  stiffness  to 
one  arm  by  using  the  second  arm  to  grasp  and  support  the  working 
arm;  provide  TV  viewing  from  a side  angle  or  varying  positions  to 
enhance  operational  cues  for  the  operator;  and  provide  operational 
redundancy  for  the  PDRS.  One  of  the  arms  is  shown  in  Figure  B-4. 

Each  arm  has  six  degrees  of  rotational  freedom,  plus  at  least  one 
degree  of  freedom  for  the  tool  located  at  the  end  of  the  arm.  A 
linear  extension  of  the  wrist  is  considered  desirable  (to  provide 
short  linear  travel  without  requiring  movement  of  the  arms)  for 
operations  such  as  initial  removal  from  the  stowage  latches  or 
engagement  of  latching  or  docking  devices.  A TV  camera  is  mounted 
near  the  wrist  to  provide  a view  of  the  hand  for  close-tolerance 
operations.  A floodlight  is  Included  in  this  installation  to  pro- 
vide the  necessary  Illumination.  This  TV  camera/floodlight  combina- 
tion can  also  be  used  for  side  viewing  of  the  other  manipulator  for 
other  operations. 

The  manipulator  operation  is  designed  basically  as  a manually 
operated  system  with  final  stowage  or  Initial  deployment  operations 
designed  as  programmed  events. 
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Figure  B-3  Docking  Concept  Alignment  Characteristics 
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Docking  Adaptor  - The  docking  adaptor  is  used  in  conjunction  with  the 
manipulators  to  execute  the  docking  maneuver  between  vehicles  re- 
quiring a transfer  of  personnel  and/or  where  the  vehicle  configura- 
tions require  a separation  distance  for  geometrical  clearances.  The 
method  of  employing  the  docking  adaptor  is  shown  in  Figure  B-4.  A 
representative  detail  of  the  adaptor  is  shown  in  Figure  B-5. 

For  orbiter-to-equipment  module  docking,  the  adaptor  is  stowed  in 
the  cargo  bay  of  the  active  arbiter.  In  these  applications,  the 
adaptor  is  removed  from  its  stowage  area  by  means  of  the  manipulator. 
It  is  then  positioned  on  the  equipment  module  to  be  docked  with  and 
latched  into  place.  With  the  manipulator  still  attached  to  the 
adaptor,  the  module  and  vehicle  are  brought  together  by  the  manipu- 
lator with  the  final  docking  and  latching  occurring  at  the  active 
orbiter.  With  the  adaptor  latched  to  both  module  and  vehicle  the 
airlock  hatches  may  be  opened  for  personnel  transfer. 

The  adaptor  is  essentially  an  open-ended  cylinder  with  automatic 
hard  docking  latches  mounted  on  each  end.  Operation  of  these 
latches  may  be  initiated  for  release  from  either  end.  This  release 
cycle  cocks  the  latches  for  the  next  docking  operation.  Each  set 
of  end  latches  may  be  selectively  operated.  The  fact  that  each  end 
of  the  docking  adaptor  provides  the  active  male  interface  enables 
all  other  interfaces  to  be  a passive  female  type,  thus  providing  the 
advantages  of  an  androgenous  system  without  the  usual  complexities. 

In  addition,  the  separate  adaptor  permits  ground  maintenance  of  the 
unit . 

Cargo  Specialist  Station  - The  cargo  specialist  station  is  located 
forward  of  the  cargo  bay  within  the  personnel-to-payload  transfer 
tunnel.  It  is  designed  to  provide  a hemispherical  field  of  vision 
for  the  cargo  specialist  for  the  complete  operation  of  payload  de- 
ployment and  retrieval  and  for  vehicle-to-vehicle  docking.  The 
payload  attach  fittings  are  designed  to  permit  angular  and  dimen- 
sional misalignments  within  the  constraints  of  the  payload  clearance 
envelope.  The  latches  are  self-aligning  and  are  provided  with 
remotely-controlled  latching  mechanisms.  Lock  and  unlock  indicators 
are  provided  in  the  cargo  specialist  station.  Normal  maintenance  of 
the  latch  and  locking  mechanism  is  accomplished  with  the  payload 
removed.  All  fittings  are  completely  accessible  from  Inside  the 
cargo  bay. 

A personnel  transfer  port  is  provided  in  the  cargo  bay  forward 
bulkhead  to  provide  personnel  access  to  either  a manned  crew  module 
(when  stowed)  or  the  cargo  bay.  The  cargo  bay  is  not  pressurized 
and  has  limited  insulation  for  temperature  control;  therefore, 
personnel  access  to  the  cargo  bay.  during  orbit  requires  EVA.  The 
personnel  transfer  port  is  on  an  extendable  section  to  provide  the 
necessary  payload  clearance  for  deployment  and  retrieval.  The  port 
is  extended  to  engage  the  payload  mating  ring  after  stowage  of  the 
payload.  The  reverse  procedure  is  required  before  payload  deploy- 
ment . 
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Figure  B-4  Standardize  Shuttle  & Prop  Module  Configuration 
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The  operator's  station  is  equipped  with  manipulator  controls  and 
the  closed-circuit  TV  displays.  A swing-away  seat  is  used  to  provide 
personnel  clearance  when  access  to  the  payload  bay  is  required. 

Figure  B-6  shows  the  general  arrangement  and  location  of  the  cargo 
specialist  station. 

The  spherical  dome  protrudes  beyond  the  basic  body  lines  to  provide 
a full  hemisphere  of  visibility.  A fairing  door  is  designed  to  cover 
the  dome  and  provide  environmental  protection  during  launch  and  re- 
entry phases. 

Closed-circuit  TV  is  used  in  conjunction  with  direct  visibility  and 
a TV  display  is  located  at  the  operator’s  station.  The  viewing  of 
the  various  TV  displays  is  achieved  by  switching  to  the  selected 
camera  system  for  display  on  the  single  unit. 

Payload  Retention  - The  payload  retention  system  is  designed  to 
accommodate  payloads  15  feet  in  diameter  by  a length  up  to  60  feet. 
The  forward  attach  fittings,  as  illustrated  in  Figure  B-7  are  de- 
signed to  take  the  axial,  vertical,  and  side  loads  that  may  be 
imposed  on  the  orblter  and  payload.  The  side  load  is  taken  on  one 
side  only  so  that  unpredicted  arbiter  or  payload  deflections  are  not 
introduced  into  the  attach  fitting.  The  aft  end  of  the  payload  is 
supported  by  a single  fitting  on  the  arbiter  centerline.  The  aft 
fitting  accepts  vertical  loads  only  and  is  designed  to  accommodate 
thermal  or  structural  deflections  in  the  lateral  direction. 

4.  LSF  Systems  Used  in  FMEA 

The  LSF  configuration  and  transfer  concept  baselined  in  the  OPSS 
feasibility  study,  NAS7-200,  Change  Order  1980,  are  presented  in 
schematic  form  in  Figure  B-8. 

a.  LSF  System  Description 

The  LSF  for  RNS  and  tug  fueling  is  based  on  rotational  accelera- 
tion for  fluid  flow  propellant  transfer  and  uses  tankage  and 
structure  components  derived  from  S-II.  The  basic  LSF  is  made 
up  of  three  separately  launched  modules  that  have  been  joined 
in  orbit.  The  largest  module  consists  of  two  LH2  tanks  sym- 
metrically located  about  a central  skirt  that  contains  docking 
ports  and  provisions  for  joining  of  the  other  modules.  The 
two  smaller  modules  are  sized  to  be  carried  within  the  shuttle 
orblter  cargo  bay.  One  is  principally  for  LOX  storage  and  it 
has  full  propellant  transfer  capability  at  its  outboard  docking 
port.  The  other  contains  most  of  the  subsystems  equipment,  has 
a crew  interface  compartment  and  has  the  primary  propellants 
transfer  docking  port  at  its  outboard  end.  Additional  modules 
to  be  considered  a part  of  the  LSF  system  are  a crew  and  main- 
tenance support  module  and  the  propellant  supply  tank. 
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Figure  B-7  Logistic  Tank  & Shuttle  Cargo  Bay  Interface 
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Figure  B-8  Baseline  Orbiter/OPD/User 
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Rotation  for  artificial  g is  the  primary  consideration  leading 
to  the  storage  tank  and  LSF  module  arrangement.  Propellant 
settling  by  centrifugal  artificial  g is  the  baseline  propellant 
•transfer  mode.  The  settling  provides  liquid-gas  interface 
'control,  allowing  pumping  of  the  propellant  and  return  of  the 
ullage  gas  from  the  receiver  tank.  Initially,  rotation  will 
take  place  about  the  combined  eg  of  the  LSF  and  the  empty  user. 

As  the  mass  of  propellants  is  transferred  to  the  user,  the  eg 
and  therefore  the  center  of  rotation  will  shift  toward  the  user. 
The  symmetrical  arrangement  and  simultaneous  transfer  from  the 
opposed  LH2  tanks  will  maintain  the  eg  location  along  the  center- 
line  of  the  smaller  LSF  modules  and  user  vehicle.  The  eg  will 
start  somewhere  between  the  LH2  tanks  and  travel  along  that 
centerline  toward  the  user.  To  preclude  sloshing  and  disturbance 
of  the  propellant  settling,  the  eg  must  not  fall  within  any  tank 
involved  in  the  propellant  transfer.  Thus,  the  equipment  module 
acts  as  a boom  to  extend  the  user  tank  beyond  the  reach  of  the 
eg  excursion.  The  location  of  the  LOX  tank  opposite  to  the  user 
docking  port  acts  as  a counter  balance  to  reduce  eg  travel. 


The  RNS  is  limited  by  eg  considerations  to  receiving  propellants 
from  the  equipment  module  docking  port.  This  is  also  the  pri- 
mary docking  port  for  tug  use;  although  limited  amounts  of 
propellants  can  be  transferred  to  tug  at  the  other  port.  Be- 
cause of  the  relatively  small  mass  of  the  supply  tank,  propel- 
lants can  be  supplied  to  the  LSF  at  either  port.  This  allows 
the  orbiter  to  first  dock  its  full  supply  tank  to  one  port  and 
then  retrieve  the  empty  tank  (to  be  returned)  from  the  other 
port.  If  it  should  prove  advantageous  (trading  off  spin  pro^ 
pellants  use  against  boiloff  from  supply  tanks),  propellants 
supply  transfer  could  be  deferred  until  two  full  tanks  are 
docked  and  could  then  be  transferred  simultaneously,  to  reduce 
the  number  of  rotations.  The  33  ft.  diameter  by  146  ft.  long 
LH2  tank  module  utilizes  S-II  derivative  hardware.  The  cylin- 
drical portion  of  the  tanks  would  be  of  aluminum  segments  simi- 
lar, if  not  identical,  to  those  on  other  S-II  type  vehicles. 

The  tank  ends  are  close  derivatives  of  the  S-II  hydrogen  tank 
forward  bulkhead.  The  outboard  skirts  are  of  similar  S-II  con- 
struction, as  is  much  of  the  central  skirt  structure.  Each 
tank  holds  50,000  cu.  ft.  The  central  portion  of  the  module 
contains  some  propellant  transfer  equipment  and  lines.  In 
addition,  the  crew  interface  docking  port  is  connected  to  the 
assembly  joint  ports  with  a shirtsleeve  pressurable  passageway. 
An  airlock  access  is  provided  for  maintenance  of  the  transfer 
lines  which  are  normally  isolated  from  the  passageway  used  by 
the  maintenance  crew.  Pumps  are  located  at  the  outboard  ends 
of  the  tanks  and  a 4-inch  transfer  line  inside  the  tank  brings 
propellants  to  the, center  of  the  module. 


The  LOX  tank  module  is  approximately  15  ft.  in  diameter  by  60  ft. 
long  for  compatibility  with  the  shuttle  orbiter  cargo  bay.  The 
tank  Itself  is  12  ft.  in  diameter  by  23  ft.  long  with  a capacity 
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of  2200  cu.  ft.  The  aluminuzn  LOX  tank  is  suspended  within  the 
primary  structure  of  the  module.  Propellant  transfer  lines 
between  the  tank  wall  and  outer  structure  connect  the  propellant 
line  interface  at  the  docking  port.  Accessibility  to  the  line 
interconnect  and  pump  end  of  the  tank  is  through  the  docking 
port. 

The  equipment  module  is  also  sized  for  orbiter  delivery.  It 
contains  most  of  the  subsystem  equipment  required  for  OPD 
operation.  The  basic  arrangement  of  the  module  is  shown  in 
Figure  B-9.  The  module  length  is  based  on  use  of  the  module 
as  a boom  to  prevent  LSF  rotation  about  a point  within  the  user 
tank.  The  module  exceeds  volumetric  requirements  of  the  present- 
ly defined  equipment  which  will  allow  accessibility  to  the  equip- 
ment for  any  on-board  maintenance.  The  Inboard  end  of  the  module 
will  be  a crew  station.  It  will  contain  equipment  for  complete 
on-board  control,  monitoring  and  checkout  of  the  LSF.  Providing 
for  these  functions  in  a compartment  integral  to  the  LSF  and 
adjacent  to  the  equipment  will  be  preferable  to  providing  it 
remotely  (telemetry)  or  through  an  interface  with  a visiting 
vehicle  or  maintenance  module.  A hatch  provides  access  from 
this  compartment  to  the  remainder  of  the  equipment  module.  The 
outboard  end  of  the  module  contains  the  line  interconnect 
equipment.  An  extendable  carrier  is  automatically  or  remotely 
actuated  to  move  the  fluid  lines  and  electrical  lines  out  to 
meet  the  receptacles  of  the  docked  vehicle.  The  carrier  and 
line  interface  is  outside  the  docking  fixture.  This  permits 
flexibility  in  the  coordination  of  vehicle  docking  in  that  the 
same  port  that  is  used  in  some  cases  for  crew  and  equipment 
transfer  (having  a 5 ft.  diameter  passage)  can  also  be  used  as 
the  propellants  transfer  docking  port.  Initial  engagement  of 
the  vehicles  is  by  the  standard  7 ft.  ring/cone  docking  fixture 
which  draws  the  vehicles  together  into  a rigidly  latched  and 
accurately  aligned  configuration.  Engagement  of  the  line  inter- 
face is  a separate  operation  following  docking.  See  Figure  B-10. 

A crew  and  maintenance  support  module  is  suggested  as  a part  of 
the  configuration.  It  would  be  a separate  module  to  be  docked 
at  one  of  the  LOX  tank  module  ports  at  all  times  when  a crew  is 
at  the  LSF.  It  would  provide  for  all  crew  housekeeping  activi- 
ties and  life  support.  The  design  of  the  module  would  share 
much  commonality  with  the  other  crew  transport  modules  used  in 
the  orbiter  and/or  the  crew  compartment  of  a manned  tug.  Main- 
tenance could  be  performed  at  the  outboard  ends  of  the  tanks 
by  transferring  the  crew  module  to  those  docking  ports,  using 
tug  or  an  orbiter  at  the  time  propellants  are  delivered.  First 
use  of  the  module  would  be  during  orbital  assembly  and  checkout 
of  the  LSF. 

Propellant  transfer  equipment  will  include  pumps  and  pressuriza- 
tion (gas  generator,  heat  exchanger)  systems.  The  pumps  must  be 
located  at  the  outboard  ends  of  the  tank  where  propellant  is 
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Figure  B-9  Equipment  Module 
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Figure  B-IO  Mechanical  Design  of  OPSS  Line  Interconnect  Fixture 
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settled.  To  facilitate  maintenance  and  replacement,  pumps  will 
be  in  sumps  that  can  be  Isolated  and  evacuated  for  access.  In- 
lets to  the  LH2  sumps  must  be  located  to  minimize  residuals. 

The  LH2  will  settle  normal  to  a radial  line  from  the  center  of 
rotation.  For  the  case  where  the  RNS  is  nearly  full  (and  LH2 
tanks  low) , the  eg  will  be  near  the  outboard  end  of  the  equipment 
module  and  propellants  will  not  be  settled  normal  to  the  center- 
line  of  the  tanks.  The  gas  generator  equipment  can  be  located 
in  the  equipment  module  to  facilitate  maintenance. 

For  thermal  control,  the  tanks  will  be  Insulated  and  isolated  as 
much  as  possible  from  surrounding  structure.  The  LH2  tank 
module  will  have  HPl  and  meteoroid  shielding  external  to  the 
cylindrical  portion  of  the  module.  The  tank  walls,  which  are 
primary  structure  of  the  module,  will  be  separated  from  other 
structure  by  a low  thermal  conductivity  skirt  immediately 
adjacent  to  the  tank  ends. 

In  the  central  skirt  section  of  the  module  the  docking  ports 
and  orbital  assembly  joints  will  be  exposed.  The  LH2  tank  ends 
will  also  be  covered  with  HPI.  The  LOX  tank  is  suspended  within 
the  module  shell  by  low  thermal  conductivity  struts  or  spokes 
and  is  surrounded  by  HPI.  Additional  insulation  and  thermal 
control  will  be  provided  for  maintenance  crew  occupancy  of 
portions  of  the  modules.  It  is  expected  that  some  thermal 
control  (coldplating) ; will  be  required  for  subsystems  equipment. 

Attitude  control  jets  are  located  on  the  outboard  ends  of  the 
LH2  tank  module.  Thrust  for  propellant  settling  spin  up  and 
despin  is  provided  by  the  ACS  and  the  outboard  location  provides 
maximum  moment  ara  for  this.  The  two  ACS  modules  would  attach 
to  outboard  ends  of  the  tank  modules  using  standard  docking 
hardware  and  would  provide  for  docking  at  its  outboard  end. 
Internal  access  would  allow  some  In-orblt  maintenance  and  the 
entire  module  can  be  replaced  and  returned  in  the  shuttle  to 
earth  for  refurbishment . Docking  and  access  to  the  pump  package 
is  also  provided  through  the  center  of  the  ACS  module. 

Maintenance  considerations  have  been  included  in  the  concept  and 
development  of  the  LSF.  Accessibility  has  been  mentioned  in  the 
previous  descriptions  of  each  module;  it  is  intended  that  almost 
all  areas  external  to  the  tanks  and  all  equipment  where  ten- 
year  reliability  is  difficult  to  achieve  would  be  accessible. 

The  crew  interface  compartment  and  passageway  from  the  crew 
docking  port  would  provide  shirtsleeve  environment.  If  possible, 
equipment  subject  to  frequent  on-board  maintenance  would  be 
located  here.  The  other  internal  areas  of  the  modules  would  be 
accessible,  but  where  maintenance  is  infrequent  and  where  con- 
struction permitting  environmental  control  (especially  long-term 
pressurization)  would  be  costly,  it  should  be  sufficient  to  pro- 
vice  only  for  suited  IVA  with  slight  pressurization  to  improve 
suit  mobility.  No  in-orbit  access  inside  any  of  the  storage 
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tanks  Is  being  considered.  The  LOX  tank  module  and  the  equip- 
ment module  can  be  considered  or  the  tradeoff  can  be  made  to 
determine  whether  Che  high  maintenance  equipment  such  as  fuel 
cells  and  batteries,  which  might  require  frequent  replacement, 
should  be  grouped  and  the  equipment  module  designed  in  two  seg- 
ments with  scheduled  replacement  of  one  segment  rather  than  the 
whole  module.  It  is  the  Intent  that  little  or  none  of  the 
maintenance  will  require  EVA.  On-board  maintenance  will  be 
limited  to  relatively  simple  remove  and  replace  Casks  with  a 
modular  approach  used  in  equipment  installation  to  facilitate 
replacement.  Installations  will  be  designed  to  simplify 
maintenance  Casks  and  provisions  such  as  handling  aids  will  be 
incorporated. 

The  launch  concept  calls  for  the  LH2  tank  structure  to  be 
launched  as  a single  payload  using  an  SS  booster  and  an  ESS. 

b . Propellant  Transfer  System 

Each  major  component  of  the  propellant  transfer  system  is 
identified  by  a number  in  Figure  B-11,  which  in  turn  is  defined 
in  Tables  B-1  through  B-5.  It  is  recognized  that  redundancy  of 
some  components  will  be  required,  but  for  purposes  of  this 
schematic  they  are  not  Included.  The  configuration  of  each 
propellant  transfer  subsystem  is  discussed  below. 

(1)  Liquid/Vapor  Interface  Control 

Liquid/vapor  interface  control  is  provided  by  centrifugal 
acceleration  Imparted  to  the  propellants  by  rotation  of  the 
combined  LSF  and  user  vehicle.  The  attitude  control  jets 
will  supply  the  thrust  for  rotational  spin-up  and  spin-down. 

To  minimize  liquid/vapor  interface  distortion  (ullage  gas 
pull  through)  during  propellant  feedout  and  therefore  mini- 
mize the  liquid  remaining  at  transfer  termination,  a tank 
outlet  sump  with  baffles  and  screens  will  be  provided.  This 
may  be  Integrated  into  a pump  package  configuration.  Anti- 
slosh  baffles  and  capillary  screens  will  also  be  utilized 
in  the  vicinity  of  the  transfer  pump  inlet  and  throughout 
the  tank  as  a secondary  means  of  liquld/vapor  Interface 
control  during  either  propellant  feedout  or  refill  opera- 
tions. Guide  vanes  will  be  needed  at  the  pump  inlet  to 
provide  minimum  fluid  disturbance  and  maximum  pump  efficiency. 

(2)  Receiver  Tank  Thermodynamic  Control 

Prior  to  a propellant  transfer,  the  chilldown  of  the  transfer 
lines  and  receiving  vehicle  tankage  will  be  achieved  by  re- 
duced liquid  flow  provided  by  the  slow  fill  pumps  or  by 
throttled  flow  utilizing  the  individual  tank  flow  control 
valves.  The  vapor  generated  by  chilldown  will  be  used  to 
supplement  ullage  pressurant  flow.  The  ullages  of  the  LSF 
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Table  B-1  Propellant  Transfer  System  Pumps 
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and  user  vehicle  will  be  connected  during  the  entire  propel- 
lant transfer  operation.  For  the  LH2  system  the  vapor  will 
return  from  the  receiver  vehicle  through  a 3-lnch  disconnect 

, and  3» Inch  lines  from  the  docking  port  Interface  to  the 
center  of  the  LSF  vehicle.  There,  It  will  subdivide  Into 
two  2-lnch  diameter  lines,  one  line  routed  to  each  of  the 
LSF  LH2  tank  ullages.  For  the  LOX  system,  the  vapor  will 
be  routed  through  a 3/4  Inch  disconnect  at  the  docking  port 
Interface  to  3/4  Inch  lines  which  are  In  turn  routed  to  the 
ullage  at  the  center  of  the  LSF. 

If  ullage  pressure  exceeds  the  design  limit,  shower  heads 
located  In  the  ullage  area  of  the  receiving  vehicle  will  be 
used  to  spray  a portion  of  the  Incoming  liquid  propellant 
Into  the  ullage  vapor.  In  this  manner,  a partial  control 
of  tank  pressure  and  temperature  will  be  achieved  by  heat 
transfer  between  Incoming  cold  liquid  droplets  and  the 
relatively  warm  ullage  vapor.  A thermodynamic  vent  system 
will  also  be  available  as  a supplementary  ullage  control. 

(3)  Expulsion 

Each  of  the  three  main  propellant  storage  tanks  (two  oppos- 
ing LH2  tanks  and  one  LOX  tank)  of  the  LSF  will  have  a pump 
package.  The  pump  package  will  be  located  at  the  tank  end 
away  from  the  center  of  rotation.  Each  pump  package  will 
consist  of  a high  capacity  transfer  pump  (fast  fill  pump) , 
a low  capacity  transfer  pump  (slow  fill  pump)  and  a relative- 
ly high  pressure  pump  for  use  with  the  pressurization  system 
heat  exchanger  and  gas  generator.  The  transfer  pump  package 
must  be  located  at  the  tank  bottom  so  that  It  will  be  con- 
tinuously covered  with  propellant  during  the  center  of 
gravity  migration  Inherent  with  transfer  operation. 

LH2  will  be  transferred  from  the  pump  package  on  each  of  the 
two  LH2  tanks  to  the  user  vehicle.  A 4-lnch  diameter  line 
will  be  utilized  from  each  LH2  tank  pump  to  the  center  of 
the  LSF.  A single  6-lnch  diameter  line  from  the  4-lnch  line 
junction  will  be  routed  to  the  docking  port  at  the  extreme 
end  of  the  equipment  module.  The  equipment  module  opposes 
the  LOX  storage  tank.  The  6-lnch  diameter  transfer  line  will 
then  subdivide  Into  two  parallel  4-lnch  disconnects  at  the 
docking  port  Interface.  Both  4-lnch  disconnects  are  required 
for  a RMS  propellant  transfer;  however,  only  one  disconnect 
Is  required  for  transfer  to  the  tug.  This  avoids  the  weight 
penalty  of  a second  (or  larger  than  required)  disconnect  on 
the  smaller  vehicles. 

Each  of  the  two  4-lnch  transfer  lines  will  have  a flow  con- 
trol valve  which  Is  used  to  balance  the  load  between  the  two 
LH2  storage  tanks.  This  provides  some  control  over  the 
center  of  gravity  of  the  mated  vehicles.  The  flow  control 
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valves  will  also  be  used  as  required  In  addition  to  the  slow 
fill  pumps  to  reduce  the  total  flow  rate  during  chill  or 
residual  minimization  throttling  operations. 

LOX  will  be  transferred  from  the  pump  package  on  the  LOX 
tank  toward  the  center  of  the  LSF  by  a 1-1/2  Inch  diameter 
line.  This  line  will  extend  to  the  docking  port  at  the  ex- 
treme end  of  the  equipment  module.  A 1-1/2  Inch  disconnect 
is  utilized  at  the  Interface. 

A second  docking  port,  similar  to  the  docking  port  on  the 
equipment  module  will  be  located  at  the  outboard  side  of  the 
LOX  storage  tank.  Although  all  space  vehicles  can  be  docked 
at  either  of  the  Interface  ports ^ the  baseline  RMS  can  only 
be  serviced  completely  at  the  equipment  module  docking  port. 
This  is  because  the  equipment  module  must  act  as  a boom  to 
prevent  the  center  of  rotation  from  entering  the  RMS  pro- 
pellant tank  during  RMS  transfer  operations.  For  this 
reason,  only  one  4-lnch  LH2  interface  disconnect  will  be 
required  on  the  LOX  module  docking  port.  Propellant  trans- 
fer operations  with  the  tug  can  be  accomplished  equally  well 
at  either  Interface  port. 

The  Interface  disconnect  sizes  for  LH2  propellant  transfer 
and  vapor  return  were  selected  to  accommodate  the  RMS.  The 
Interface  disconnect  sizes  for  LOX  propellant  transfer  were 
selected  to  accommodate  the  tug.  Therefore,  the  LH2  4-lnch 
disconnect  at  the  LOX  tank  docking  port  Interface  is  con- 
nected to  the  LH2  tank  transfer  system  by  a 3-inch  diameter 
line,  the  LH2  3-lnch  vapor  return  disconnect  at  the  LOX  tank 
docking  port  Is  connected  to  the  LH2  vapor  return  system  by 
a 1-1/2  Inch  diameter  line. 

(4)  Pressurization 

Ullage  pressurization  required  prior  to  propellant  transfer 
will  be  accomplished  with  a single  gas  generator.  The 
pressurization  Is  necessary  to  prevent  the  formation  of 
vapor  in  the  transfer  system.  The  gas  generator  will  supply 
a heat  exchanger  for  each  of  the  two  transfer  systems  (LH2 
and  LOX) . A pump  In  the  pump  package  of  each  tank  will 
supply  the  liquid  propellant  to  the  gas  generator  and  heat 
exchangers.  The  two  1/2  inch  diameter  gas  generator  supply 
lines  from  the  LH2  tanks  will  be  routed  through  a single 
regulator.  The  regulated  output  will  then  separate  to  supply 
the  gas  generator  and  the  LH2  pressurant  inlet  to  the  heat 
exchanger.  The  gas  generator  will  supply  hot  gas  to  the 
heat  exchanger  for  vaporization  of  the  hydrogen  pressurant. 
The  vaporized  pressurant  is  then  routed  to  the  LH2  tank 
ullages  of  the  LSF  and  interfacing  vehicle.  The  single 
1/2  Inch  diameter  line  from  the  LOX  GG  pump  Is  routed  through 
a regulator  to  the  gas  generator  and  LOX  heat  exchanger  in 
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a manner  similar  to  that  for  the  LH2  pressurization  system. 

The  vaporized  pressurant  Is  then  routed  to  the  LOX  tank 
ullages  of  the  LSF  and  Interfacing  vehicle.  After  passing 
through  the  heat  exchangers,  the  products  of  the  gas  genera- 
tor are  vented  Into  space. 

Transfer  line  valves  will  be  arranged  so  that  the  propellant 
storage  tanks  can  deliver  and  receive  propellants  through  a 
common  system  of  transfer  lines  and  vapor  return  lines.  The 
pumps  used  for  propellant  transfer  will  be  mounted  In  the 
tanks.  This  will  minimize  the  ullage  pressure  required  for 
pump  NFSH  by  eliminating  suction  line  pressure  losses  upstream 
of  the  transfer  pump.  The  ullage  pressurization  systems  on 
the  LSF  will  be  used  to  pressurize  all  tanks  Including  re- 
supply tanks. 

c.  CIS  Baseline  Vehicle 

The  CIS  baseline  vehicle  considered  as  an  alternate  for  the  RNS 
baseline  vehicle  requires  a 6-lnch  diameter  LOX  and  LH2  propel- 
lant transfer  system.  It  Is  anticipated  that  the  two  4-lnch 
disconnects  for  LH2  transfer  to  the  RNS  can  be  utilized  for  the 
CIS  baseline.  Further,  It  is  anticipated  that  the  same  two 
4-lnch  disconnects  planned  for  LH2  transfer  system  design  can 
be  utilized  for  LOX  transfer  to  the  CIS  baseline  vehicle. 

5.  Conceptual  Tug  and  Applicable  Systems  Used  In  FMEA 

The  basic  conceptual  configuration  of  the  tug  as  involved  In  this 
safety  study  Is  presented  In  Figure  B-12.  The  conceptual  description 
of  tug  subsystems  follows. 

a.  Guidance,  Navigation  and  Control  Subsystem 

The  GN&C  system  components  of  the  space  tug  are  briefly  des- 
cribed here  for  the  Intelligence  module  basic  GN&C  equipment, 
crew  module  basic  GN&C  equipment  and  rendezvous  and  docking  GN&C 
equipment . 

(1)  Intelligence  Module  Basic  GN&C  Equipment 

The  IM  basic  equipment  consists  of  an  IMU  with  associated 
preprocessor,  glmbaled  star  trackers  for  attitude  reference, 
sun  sensors  for  attitude  acquisition  and  sun  pointing 
attitude  hold,  horizon  tracker (s)  for  navigation  measure- 
ments up  to  geosynchronous  altitude,  and  navigation  sensor 
base  for  the  star  trackers  and  IMU.  For  adequate  fields  of 
view  for  the  star  trackers  while  making  horizon  tracker 
measurements  In  low  earth  orbit,  the  horizon  tracker (s)  Is 
mounted  on  the  opposite  side  of  the  IM  from  the  navigation 
base  and  sensors. 
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The  IM  also  contains  the  electronics  for  controlling  the 
ACS  reaction  jets  (ACS  driver  amplifiers)  and  the  main 
engine  gimbals  and  throttling  (engine  glmbal  amplifiers). 

In  addition  to  this  equipment  the  GN&C  system  will  use  the 
computers,  central  timing  unit,  data  bus,  and  signal  con- 
ditioning units,  which  are  part. of  the  communications  and 
data  management  system. 

Most  GN&C  signals,  commands,  and  data  within  the  IM  will 
be  carried  on  the  data  bus  as  part  of  the  C&DM  system. 

Some  signals  and  commands  to  the  reaction  jets  and  main 
engines  will  be  carried  on  separate  w,lres. 

(2)  Crew  Module  Basic  GN&C  Equipment 

The  crew  module  basic  GN&C  equipment  consists  of  rotation 
and  translation  controllers  to  manually  control  the  space 
tug  with  the  ACS  reaction  jets;  a triad  of  attitude/rate 
gyros  and  a longitudinal  integrating  accelerometer  mounted 
on  the  telescope  base  to  provide  a backup  attitude  control 
and  manual  thrust  maneuver  control  system;  a semi-automatic 
telescope  with  pointing  controls  and  base  for  navigation 
sightings  and  lunar  landing  site  tracking;  manual  control 
electronics;  an  ACS  control  mode  selection  panel;  and  a 
GN&C  power  control  panel.  The  rotation  controllers  are 
also  used  to  manually  control  the  main  engine  gimbals, 
through  the  manual  control  electronics  unit,  during  manual 
thrust  maneuvers. 

In  addition  to  the  components  above,  the  crew  will  use  for 
GN&C  operations  the  alphanumeric  and  multi-format  graphics 
displays  and  the  two  keyboards  for  requesting  displays  or 
entering  data  Into  the  computer.  The  displays  and  key- 
boards are  part  of  the  C&DM  System. 

(3)  Rendezvous  and  Docking  GN&C  Equipment 

Sensors  required  for  rendezvous  and  docking  are  a rendez- 
vous and  docking  radar  mounted  on  the  docking  face  for 
target  acquisition,  tracking,  and  automatic  docking;  a 
docking  television  camera,  also  mounted  on  the  docking 
face,  for  crew  or  ground  monitoring  of  automatic  docking 
and  manual  completion  of  docking  If  necessary;  and  contact 
sensors  to  Indicate  when  latching  of  the  docking  mechanism 
has  been  completed. 

Equipment  required  on  target  vehicles  consists  of  corner 
reflectors  or  a laser  radar  transponder  mounted  on  the 
docking  face,  and  visual  docking  aids,  consisting  of  a 
distinctive  pattern,  standoff  cross,  etc.,  on  the  docking 
face  to  provide  visual  cues  for  manual  docking.  Non- 
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cooperative  rendezvous  can  be  accomplished  only  by  adding  a 
skln-tracklng  rendezvous  radar  to  the  tug  or  part  o£  the 
payload. 

b.  Co^nimlcatlons  and  Data  Management  Subsystem 

The  communications  and  data  management  subsystem  provides  the 
capability  for  acquisition,  processing,  storage,  and  both  In- 
ternal and  external  exchange  of  Information  related  to  tug 
checkout,  monitoring,  and  operations.  The  subsystem  supports 
the  mission  concepts  without  re-conflguratlon  within  Individual 
modules,  with  the  exception  of  software. 

(1)  Communications 

Communications  parameters  establishing  requirements  for 
transmitter  power,  antennas,  receivers,  and  operational 
limitations  Include  the  Information  rates  and  quality 
(required  slgnalto-nolse  ratio,  or  error  rates)  and  the 
geometry  of  the  links.  Four  classes  of  Information  are 
provided  for  the  tug  missions.  A low  data  rate  capability 
Includes  commands,  tracking  Information,  gears  status 
measurements,  and  voice.  This  link  would  be  capable  of 
data  rates  up  to  »A000  bits  per  second. 

Moderate  rates  are  required  for  remote  monitoring  of  vehicle 
subsystems'  response  to  commands  or  status  during  critical 
periods,  checkout  routines  and  dumps  of  stored  data.  Rates 
are  assumed  up  to  500,000  bits  per  second. 

Television  capability  equivalent  to  that  on  Apollo  provides 
a general  video  monitoring  capability  for  overall  situation 
assessment.  The  link  capacity  also  could  be  used  for  high 
speed  data  dumps  or  for  simultaneous  transmission  of  several 
channels  of  data  over  the  link. 

(2)  Data  Management 

The  major  requirements  affecting  the  data  management  are 
rates.  Information  storage  requirements,  and  subsystem 
Interfaces. 

The  operational  memory  Includes  the  rapid  access  (nano- 
seconds) programs  required  for  essentially  real  time  control 
of  the  subsystem.  Including  data  management.  Mass  memory 
Includes  programs  which  are  accessible  In  milliseconds. 

It  Is  supplemental  to  the  operational  memory  and  stores 
long  term  operational  programs,  alternatives,  data  for  long 
term  analysis,  and  any  special  mission  Information. 
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(3)  Link  Frequencies 

Frequency  selection  is  optimized  in  terms  of  power,  band- 
width, coverage,  and  antenna  requirements.  The  frequency 
spectrum  is  heavily  assigned  and  utilized,  with  both  inter- 
national and  Government  agreement  required  for  operation  in 
specific  frequency  ranges.  Earth  and  moon  programs  will 
apparently  still  be  largely  using  S-Band  frequencies  in  the 
vicinity  of  2.3  GH2.  The  TDRS  link  may  be  either  S or  Ku 
(around  13.5  GH2)  band. 

(A)  Antennas 

Omni-directional  antennas  will  provide  adequate  gain  for 
low  data  rate  links,  and  for  high  data  rates  at  shorter 
ranges.  Directional  antennas  will  be  required  for  longer 
ranges  and  for  relative  angle  measurements.  The  parabolic 
design  is  the  choice  for  this  concept. 

(5)  Tracking 

The  tracking  subsystem  includes  the  capability  to  transpond 
a ranging  signal  from  the  MSFN  or  other  space  elements,  and 
to  perform  ranging  on  cooperative  targets  as  well  as  deter- 
mine relative  bearings  to  the  target.  This  capability  is 
good  to  within  1000  feet.  Closer  approaches  will  be 
supported  by  the  GN&C  subsystem  with  a laser  radar  or  by 
video  camera  assigned  to  the  GN&C. 

(6)  Multiplexing 

Video  and  voice  are  basically  analog  signals  which  lend 
themselves  to  frequency  division  multiplexing  (FDM) , unless 
a very  large  number  of  channels  are  Involved.  The  tug  will 
have  a small  number  of  such  channels  and  will  not  approach 
the  complexity  required  to  consider  time  division  multiplex 
(TDM) . The  digital  signals  are  inherently  TDM. 

(7)  Storage 

Operating  and  mass  memory  will  be  the  plated  wire.  It 
should  be  noted  that  scratchpad  memories  within  the  pro- 
cessor probably  will  be  solid  state  to  achieve  the  high 
speed  needed. 

Archival  memory  consists  of  long-term  records  of  data 
samples,  alternate  programs  for  mass  memory,  collections 
of  unprocessed  data  for  later  transmission  to  the  MSFN, 
or  other  information  for  which  access  is  not  time-critical. 
Tape  machines  are  used  for  this  type  of  storage  on  the  tug. 
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c.  Electrical  Power  Subsystem 

Two  fuel  cells  will  provide  the  voltage  regulation  and  redundan- 
cy capability  for  the  main  power  subsystem  for  unmanned  missions. 
Two  3-phase,  400  Hertz  inverters  are  Included  for  alternating 
current  (AC)  loads  in  the  otherwise  direct  current  (DC)  power 
subsystem  configuration.  Two  secondary  peaking  batteries  will 
supplement  the  fuel  cells  for  peak  loads  and  emergency  power 
requirements.  Power  will  be  distributed  to  decentralized 
power  control  centers  throughout  the  vehicle  with  due  regard 
for  electromagnetic  compatibility  considerations.  Solid-state 
switching  devices  and  circuit  breakers  will  be  used  for  switch- 
ing and  control  where  practical.  Cooling  of  solid-state  con- 
version equipment  and  batteries  will  be  effected  through  mount- 
ing on  cold  plates.  Fuel-cell  cooling  will  be  effected  through 
the  tug  heat  Injection  radiator  loops. 

d.  ACPS  Subsystem 

The  ACPS  is  a pump-fed  system  utilizing  gaseous  oxygen  and 
gaseous  hydrogen,  which  has  a capillary  device  in  the  main 
tanks  for  liquid  feed  to  the  pumps.  Four  engines  with  200- 
pound  thrust  engines  throttable  to  40  pounds  thrust  are  pro- 
vided. Accumulators  provide  20  seconds  of  propellant  to  the 
engines.  The  conditioning  unit  response  time  is  5 seconds. 

(1)  Capillary  Device 

The  capillary  device  in  the  main  tanks  will  supply  200  lbs. 
of  propellant  to  the  ACPS  between  any  two,  or  after  the 
last  main  engine  burns. 

An  umbrella-type  dutch  twill  screen  of  30  by  230  mesh  with 
pore  openings  of  0.00276  inch  assures  propellant  retention, 
but  provides  sufficient  opening  for  low  pressure  loss  during 
propellant  flow  and  for  rapid  refilling.  The  retention 
screen  is  mounted  on  a conical  frame  for  strength,  refilling 
and  bubble  purging  during  main  engine  burn.  For  adequate 
refilling  of  the  compartment,  the  half  cone  angle  should  not 
exceed  80  degrees. 

(2)  Propellant  Acquisition  and  Expulsion 

A propellant  collector  is  provided  within  the  retention 
compartment  and  provides  two  pounds  per  second  flow  rate, 
collects  propellant  after  gas  breaks  through  into  the  com- 
partment, and  prevents  gas  passage  into  the  collector. 
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(3)  Tankage 

The  common  tankage  system  Includes  a supply  of  cryogenics 
for  main  propulsion  and  a llquld-to-gas  conversion  system 
for  ACS,  EPS  and  ECLSS. 

Liquid  oxygen  and  liquid  hydrogen  are  stored  in  main  tanks 
at  20  psla.  After  conversion,  the  gases  are  stored  in  the 
accumulators  at  350  to  1000  psia.  Through  regulators, 
pressure  is  lowered  to  300  psia  for  ACPS,  50  to  1000  psia 
for  the  EPS,  and  5.5  to  14.7  psia  for  the  ECLSS.  In  the 
crew  module,  an  intermediate  oxygen  storage  container  is 
provided  at  the  accumulator  pressure. 

e.  Docking  Subsystem 

An  Apollo  docking  system  is  used  for  the  tug  with  the  probe 
being  forward  and  the  drogue  located  aft  Inboard  of  the  main 
engines . 

6.  Centaur  Systems  Used  in  FMEA 

The  conceptual  Centaur  configuration  used  in  the  representative 
propellant  logistic  operations  is  based  on  the  Centaur  version  as 
contained  in  the  General  Dynamics  Centaur /Shut tie  Integration 
Report  )!IGDC-BNZ70-024.  Figure  B-13  Illustrates  the  basic  Centaur 
configuration. 

a.  Tanks  and  Structure 

The  tank  structure  consists  of  a thin-walled,  301  stainless 
steel,  monocoque  cylindrical  section,  capped  at  both  ends  by 
stainless  steel  bulkheads.  A double-walled,  insulated, 
ellipsoidal  inner  bulkhead  provides  separation  between  the 
liquid  oxygen  (LO2)  tank  and  the  liquid  hydrogen  (LH2)  tank. 

The  payload  support  structure  on  Centaur  is  designed  for 
12,000-pound  payloads,  carrying  them  on  a truss  structure  with 
a 10-foot  Interface  diameter.  Payloads  weighing  less  than 
5,000  pounds  can  be  carried  on  the  equipment  module  with  a 
65.92-inch-diameter  bolt  circle. 

b.  Main  Engine  System 

Primary  vehicle  thrust  is  provided  by  two  Pratt  & Whitney 
RLlOA-3-3  engines  which  are  capable  of  performing  multiple 
starts  in  space,  and  have  the  following  performance  character- 
istics. 
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Thrust  (nominal) 

Chamber  Pressure 
Mixture  Ratio  (nominal) 

Specific  Impulse,  Igp  (nominal) 

Rated  Operating  Duration  (per  firing) 


15,000  lb 
400  psla 
5:1 

444  sec 
450  sec 


c.  Tank  Pressurization 


The  airborne  tank  pressurization  subsystem  consists  of  the 
helium  storage  bottle,  tubing,  and  the  various  check  valves, 
restrictors,  and  shutoff  valves  required  to  deliver  pressurized 
helium  from  the  storage  bottle  to  the  tanks.  Vent  valves  on 
the  propellant  tanks  prevent  overpressurization  of  the  tanks . 

Prior  to  tanking,  propellant  tanks  are  pressurized  directly 
from  ground-supplied  helium.  At  the  start  of  tanking,  boiloff 
provides  pressurization  which  is  .regulated  by  vent  (boiloff) 
valves  on  each  tank.  Fuel  tank  pressure  is  nominally  21  psla; 
oxidizer  tank  pressure  Is  30  psla. 

Propellant  tank  pressurization  is  Increased  prior  to  each  main 
engine  start  to  prevent  boost-pump  cavitation  by  increasing  the 
net  positive  suction  head.  Vent  cycles  are  required  at  about 
two-hour  Intervals  on  long  coasts. 

d.  Propellant  Feed 

The  propellant  feed  system  consists  of  fuel  and  oxidizer  sump- 
mounted  boost  pumps,  propellant  feed  ducts,  and  recirculation 
lines  to  maintain  liquid  at  the  engine  inlet  shutoff  valves. 
Propellant  flow  is  Initiated  by  a centrifugal-flow  boost  pump 
submerged  in  each  propellant  tank.  See  Figure  B-14. 

e.  Propellant  Utilization  System 

The  propellant  utilization  (PU)  system  adjusts  the  propellant 
mixture  ratio  of  the  main  engines  to  ensure  that  propellant 
residuals  at  the  termination  of  powered  flight  are  at  a minimum. 
Control  is  achieved  by  varying  oxidizer  flow  through  the  engines 
as  a function  of  the  propellant  masses  remaining  in  the  vehicle 
tanks . 

The  PU  system  consists  of  five  major  components:  fuel  and 

oxidizer  tank  propellant  sensors  (capacitance  probes) , an 
electronics  package,  and  two  servo-positioners. 

f . Thermal  Control 


The  cylindrical  portion  of  the  liquid  hydrogen  tank  is  insulated 
by  a radiation  shield  consisting  of  three  layers  of  aluminized 
ttylar.  The  shield  is  effective  against  solar  heating  and  earth 
radiation  and  improves  the  capability  of  the  Centaur  to  perform 
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long-coast  missions  by  reducing  hydrogen  boiloff  significantly. 
The  shield  reduces  sidewall  heating  by  a factor  of  over  40  com- 
pared to  bare  walls,  which  reduces  total  hydrogen  tank  heat  in- 
put (including  bulkheads)  by  a factor  of  10.  The  shielding 
arrangement  results  in  propellant  tank  maximum  extended  operation 
heating  rates  of  approximately  3080  BTU/hr  and  2070  BTU/hr  for 
the  LH2  and  LO2  tanks  respectively. 

g.  Astrionics 


The  Centaur  Astrionics  System  consists  of  the  following  units: 

Digital  Computer  Unit  - DCU 
Inertial  Measurement  Group 
Sequence  Control  Unit 
Servo  Inverter  Unit 
Propellant  Utilization 

(1)  A simplified  block  diagram  of  the  system  appears  in 
Figure  B-15.  The  DCU  is  a stored  program  digital  computer 
with  a 16,384  word  by  24  bit  ferrite  core  memory. 

(2)  The  Inertial  Measurement  Group  in  conjunction  with  the  DCU 
makes  up  the  Centaur  vehicle  inertial  guidance  system.  The 
IMG  consists  of  the  Inertial  Reference  Unit  (Platform)  and 
the  System  Electronics  Unit  and  provides  vehicle  velocity 
data  to  the  DCU  and  transforms  Inertial  coordinates  to 
vehicle  coordinate. 

(3)  The  Sequence  Control  Unit  provides  prelaunch  and  inflight 
control  of  the  vehicle  systems  and  contains  a relay  switch 
section,  a decoder  section  and  a power  switch  section. 

(4)  The  Servo  Inverter  Unit  provides  control  of  the  engine 
actuators  by  signals  from  the  DCU.  It  also  contains  a power 
conversion  section  for  providing  AC  power  by  the  vehicle 
systems. 

(5)  The  Propellant  Utilization  system  provides  inflight  control 
of  the  propellant  masses  to  minimize  end  residuals. 

h.  Electrical  System 

The  Centaur  electrical  system  supplies  and  distributes  28-volt 
DC  power,  and  distributes  115-volt  and  26^olt,  single  phase, 
4OO-H2  AC  power  to  the  various  Centaur  systems  during  checkout, 
countdown,  and  flight  operations.  It  provides  remote  internal/ 
external  power  changeover  switching  and  remote  safety  function 
safe  and  arm  switching  capability. 
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, CENTAUR  ATTITUDE 
CONTROL  ENGINE  COMMANDS 
OTHER  CENTAUR  FUNCTIONS 


►PAYLOAD 


GSE  DATA  LINK 
PCM  DOWN  LINK 
PCM  BIT  STREAM 
TO  8-BAND  TRANSMITTER 


-START  DCU  COUNT 


DC  D/A'S 


800  PFS  inverter  REFERENCE 


FEEDBACK 

TRANSDUCER 

EXCITATION 


Figure  B-15  Astrionics  System 
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i.  Emergency  Propellant  Dump  System 

Abort  Requirements  - The  Centaur  must  be  able  to  dump  its  pro- 
pellants during  an  emergency  abort  situation  In  order  to  prevent 
landing  the  shuttle  orblter  with  a fully  loaded  stage  In'  the 
cargo  bay.  In  order  to  accomplish  this  the  fill  and  drain  lines 
have  been  Increased  to  6-inch  diameter  and  provisions  made  to 
pressurize  the  propellant  tanks  to  the  allowable  maximum 
(44  psla  In  the  LO2  tank  and  29  psla  In  the.  LH2  tank) . The 
assumed  vapor  pressure  for  the  propellants  Is  20  and  30  for 
the  LO2  and  LH2  respectively,  giving  available  driving  AP's  of 
9 psla  for  LH2  dumping  and  14  for  LO2  dumping.  If  both  dump 
lines  (l.e.,  fill  and  drain)  are  Increased  In  size  to  6-lnch 
diameter  the  LO2  can  be  dumped  In  approximately  70  seconds  and 
the  LH2  In  approximately  60  seconds.  The  propellants  should  be 
dumped  sequentially  during  an  abort  situation ^ requiring  just 
over  2 minutes  for  the  entire  dump  process.  Approximately 
900  Ibf  and  1200  Ibf  thrust  will  be  generated  by  the  LH2  and  LO2 
vent  fluid. 

In  order  to  maintain  the  desired  tank  pressures  during  emergency 
abort  It  Is  necessary  to  provide  helium  pressurant  which  is 
carried  in  the  cargo  bay  specifically  for  this  purpose.  This 
helium  Is  stored  In  five  27.25  Inch  spherical  bottles  which 
contain  a total  of  30  cubic  feet  of  ambient  temperature  helium 
at  3000  psl.  They  are  plumbed  Into  the  tank  pressurization 
system  via  the  two  ground  lines  passing  through  the  T-4  panel, 
and  are  filled  during  countdown  by  a tee  from  the  helium  charge 
line  which  also  passes  through  the  T-4  panel.  This  supply  Is 
also  used  to  open  the  Centaur  fill  and  drain  valves  to  permit 
propellant  dumping.  Helium  must  be  supplied  at  800  psl  to  open 
these  valves.  Since  the  main  helium  supply  bottle  pressure 
decays  to  approximately  100  psl  at  the  completion  of  propellant 
dump,  a separate  reservoir  Is  needed  to  maintain  a high  fill 
and  drain  valve  supply  pressure  during  the  final  dumping  phase. 

7.  Failure  Mode  and  Effects  Analysis  Sheets 

The  FMEA  for  the  Representative  Orbital  Propellant  Logistic  baseline 
and  both  tug  and  ESS  variations  are  contained  on  the  following 
sheets.  As  In  the  case  of  FFD  Identification,  the  FMEA  sheets  for 
the  tug  variations  for  delivery  function  sharing  Is  coded  with  an  A. 
The  ESS/large  propellant  tank  variation  for  propellant  delivery  to 
a CIS/RNS  Is  coded  with  a B. 
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APPENDIX  C 

HAZARD  ANALYSIS  SHEETS 

This  appendix  Includes  those  hazards  identified  and  associated  with  the 
representative  orbital  propellant  logistic  operations  described  In  Appendix  A. 
Potential  hazards  directly  related  to  those  identified  by  the  FMEA's  plus 
operational  and  Interface  hazards  associated  with  a particular  functional 
block,  are  structured  to  present  the  hazards  as  they  flow  through  the  func- 
tional blocks  identified  In  Appendix  A. 

Definition  of  Safety  Terms 

The  following  terms  used  in  this  document  are  defined  as  follows: 

a.  Hazard  - The  presence  of  a potential  risk  situation  caused  by  an 
unsafe  act  or  condition. 

b.  Risk  - The  potential  for  Injury  or  loss  of  personnel,  equipment  or 
property. 

c.  Major  damage  - Damage  by  unprogrammed  or  unscheduled  events  which 
results  in  major  system  degradation  or  loss. 

d.  Major  system  degradation  - A condition  which  results  in  one  or  more 
of  the  following: 

(1)  Jeopardized  achievement  of  an  operation  or  performance  of  a 
mission;  or  delay  beyond  acceptable  time  limits. 

(2)  Inadvertent  system  activation. 

Hazard  Groups 

There  were  12  hazard  groups  used  in  the  study.  These  are  representative 
of  the  hazards  which  could  be  broadly  grouped  from  the  various  phases  of  the 
missions  and  operations  of.  the  representative  orbital  propellant  logistic 
concept.  Because  of  the  broad  grouping,  the  reader  may  note  considerable 
interaction  or  overlap  between  the  selected  groups.  Assignment  of  a hazard 
to  the  hazard  groups  was  made  by  the  individual  system  safety  engineer  and, 
in  some  cases,  is  grouped  by  a purely  arbitrary  decision,  which  is  not  un- 
common in  such  cases. 

1.  Fire/Exploslon/Implosion 

This  group  includes  hazards  which  are  created  by  chemical  reactions, 
catalytic  action,  frictional  effects,  or  other  heat  generating  prin- 
ciples, where  fire  can  be  initiated  by  hypergolic  action  or  initiat- 
ing source. 
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It  further  Includes  explosions  initiated  by  fire  or  spark  and  those 
which  are  not  necessarily  fire  Initiated  such  as  overpressurization. 
Instantaneous  release  of  high  pressures  by  container  fracture,  or 
reactions  In  ambient  conditions  where  gaseous  hydrogen  and  oxygen 
are  combined  In  quantities  of  4 and  2 percent  by  volume  respectively, 
or  greater,  and  the  resulting  mixture  Is  subjected  to  pressures  of 
2 mm  of  Mercury  or  more  and  subjected  to  Initiation  source,  such  as 
catalytic  reaction  with  nickel,  zirconium,  etc..  Impact  or  spark. 

Implosion  Includes  those  hazards  In  which  an  adverse  AP  Is  created 
across  a structure  (tank)  by  reducing  Internal  pressure  such  as 
during  drainage  of  fluid  from  a locked  up  volume,  cryo-pumplng , or 
venting  to  vacuum  and  locking  the  tank  up  for  re-entry  Into  the 
earth's  atmosphere. 

2.  Reduced  Integrity  of  Structure  or  Equipment 

This  group  Includes  conditions  which  subject  a structure  or  equip- 
ment to  some  level  of  degradation,  such  as  possible  adverse  stress 
due  to  exposure  to  extreme  temperature  slugging,  damage,  scrubbing 
Interaction  between  fluids  and  materials,  reduction  In  critical 
characteristics  or  materials  capability,  functional  degradation  or 
loss  of  supporting  equipment,  and  out  of  sequence  operations. 

(1)  Loss  of  pressurization,  (2)  thermal  shock,  (3)  failure  of  line 
Interconnect  fixtures,  (A)  leakage  or  mass  spill,  (5)  loss  of  liquid 
vapor  Interface  control,  and  (6)  degradation  of  manned  elements  are 
sub  groups.  Parentheses  ( ) Indicate  sub  group  code. 

3 . Contamination 

This  group  Includes  hazards  related  to  those  conditions  producing  or 
Introducing  contamination.  The  amount  of  the  contaminating  media 
Includes  that  which  Is  needed  to  create  the  contamination  and  ranges 
from  traces  to  large  particulates.  Products  of  combustion.  Ice 
crystals,  and  metal  chips  are  examples. 

4 . Corrosion 

This  group  includes  those  conditions  which  adversely  damage  per- 
sonnel or  material  surfaces  by  chemical  attack. 

5.  Toxicity 

This  group  Includes  hazards  related  to  production  of  a toxic  sub- 
stance which  affects  the  human  body  adversely. 

6.  Heat  and  Temperature 

This  group  Includes  those  conditions  related  to  excursions  of  tem- 
perature bracketing  extreme  heat  to  extreme  cold. 
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7.  Loss  of  Thrust 

This  group  covers  those  cases  where  loss  of  thrust  Is  'experienced 
when  needed  for  scheduled  operations.  It  Includes  main  and  auxiliary 
propulsion  engines  and  propulsive  vents. 

8.  Unscheduled  Vehicle  Impact 

This  group  includes  impact  hazards  Involving  loss  of  target  by  the 
vehicle  avionics  or  ground  net,  meteoroid  and/or  space  debris  with 
the  vehicle,  mechanical  failures  or  delays  in  valve  actuation  for 
any  reason,  loss  of  docking  aids  or  Incorrect  approach  alignment 
and  Inadvertent  or  mlsoperatlon  of  RCS,  propulsive  vents,  etc. 
Manipulator  related  hazards  such  as  loss  of  TV  and  lighting,  cargo 
with  structure  impacts  and  damage  caused  by  sloshing  or  unstabillzlng 
effects  are  also  Included.  Human  error  has  been  Included  in  the 
group  as  related  to  Impacts  while  exercising  manual  control  of  the 
vehicle  or  introduction  of  commands  for  remote  activation. 

9.  Loss  of  Attitude  Control 

This  group  includes  those  hazards  where  the  inability  to  achieve 
stabilization  for  any  reason  prevails,  such  as  lack  of  or  inter- 
mittent RCS  operation,  CG  shift  during  rotation.  This  also  Includes 
the  conditions  where  application  or  release  of  tension  loads  causes 
instability  within  the  configuration  for  any  time  duration,  without 
damping . 

10.  Loss  of  Habitable  Environment 

This  group  includes  any  condition  which,  through  its  occurrence, 
would  render  the  manned  volume  unfit  for  unsulted  occupancy.  Such 
conditions  Include  hazards  such  as  decompression  by  penetration, 
long-term  leakage  or  seal  failures  which  give  unscheduled  depletion 
of  oxygen  supply,  contamination,  heat,  humidity  and  loss  of  CO2 
control. 

11.  Loss  of  Communication 

This  group  Includes  loss  of  ability  to  send  or  receive  programmed 
data  under  operational  conditions.  It  encompasses  radio,  radar, 
laser,  TV,  hard  wire  communications  and  necessary  equipment,  GSE, 
facilities  or  satellites  associated  with  the  communication  process. 

12.  Disturbances 

Included  in  this  hazard  group  are  those  conditions  which  can  affect 
stability  conditions  adversely,  such  as  sloshing  and  CG  shift 
coupling  with  the  dynamics  of  the  vehicle  or  configuration,  RCS 
interaction  therewith,  tank  inlet  fluid  momentum  distorting  the 
liquid  surface,  or  combinations  initiating  such  conditions,  including 
impact  and  wobble.  (1)  Sloshing,  (2)  dynamic  coupling,  (3)  loss  of 


- 316  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


CG  control,  and  (4)  uncontrolled  venting  are  sub  groups.  Parentheses 
( ) indicate  the  sub  group  code. 

Hazard  Analysis  Form  Description 

The  continuity  of  story  flow  through  the  representative  orbital  propel- 
lant logistic  operation  is  maintained  in  the  use  of  the  Hazard  Analysis  form. 
This  comes  about  in  the  manner  in  which  the  operation/phase  is  described; 
l.e.,  as  the  function  is  described  in  the  FFD  for  those  referenced  under  the 
heading  "References . " 

Potential  hazards  identified  with  their  effects  have  been  described  and 
are  contained  herein.  The  material  then  was  reviewed  for  corrective  measures 
required  for  description  of  action  recommended . 

The  complete  story  is  thus  contained  on  the  Hazard  Analysis  form,  when 
used  in  conjunction  with  the  applicable  FFD  which  has  the  same  reference 
mmber  as  the  HA  reference. 

The  code  for  the  Hazard  Analysis  forms  used  in  the  ISPLS  Study  involving 
operation/phase,  hazard  group  and  subsystem  is  as  follows: 

Operation/ 


Phase 

Code 

Hazard  Group 

Code 

Subsystem 

Code 

Prelaunch 

A 

Flre/Exploslon/Implosion 

1 

Avionics 

1 

Reduced  Integrity  of 

Propulsion 

2 

Launch/ 

Structure  or  Equipment 

2 

Vehicle  Support 

3 

Ascent 

B 

Contamination 

3 

Mechanical 

4 

Corrosion 

4 

Structural 

5 

Orbital 

C 

Toxicity 

5 

Materials 

6 

Heat/Temperature 

6 

GSE 

7 

Deorblt 

D 

Loss  of  Thrust 

7 

Facilities 

8 

Unscheduled  Vehicle  Impact 

8 

Payload 

9 

Landing 

E 

Loss  of  Attitude  Control 

9 

Saflng 

10 

Loss  of  Habitable 

Propellant 

11 

Saf ing 

F 

Environment 

10 

Human 

12 

Loss  of  Communication 

11 

Pressurization 

13 

Disturbances 

12 

The  Hazard  Classes  used  are  those  categorized  in  OMSF  Safety  Program 
Directive  Ol,  Revision  A,  dated  December  12,  1969,  re-stated  here  in  modified 
form  for  purposes  of  this  conceptual  study.  See  Table  C-1. 
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HAZARD 

CLASS 

MISSION 

GOALS 

SYSTEM 

SAFETY 

FACILITY 

SAFETY 

CREW 

SAFETY 

Catastrophic 

Mission 

Loss 

Vehicle  Loss 
or  Extensive 
Damage 

Loss  or 
Considerable 
Facility 
Damage 

Multiple 
Injury 
or  Death 

Critical 

Major 

Degradation 

Substantial 

Equipment 

Loss 

Substantial 

Loss 

Injury 

Marginal 

Minor 

Degradation 

Minor 

Equipment 

Loss 

Minor 

Loss 

Can  be 
Controlled 
to  Prevent 
Injury 

Negligible 

No  Effect 

No  Loss 

No  Loss 

No  Injury 

Table  C-1 


The  action  reconmended  covers  one  or  more  recommended  means  to  eliminate 
or  reduce  the  hazard.  If  the  hazard  cannot  practically  be  eliminated  the 
actions  for  reducing  the  hazard  In  order  of  precedence  are  those  contained  in 
OMSF  Safety  Program  Directive  No.  1,  Revision  A,  condensed  here  for  conven- 
ience of  the  reader. 

a.  Design  for  minimum  hazard. 

b.  Use  appropriate  safety  devices. 

c.  Provide  devices  for  timely  detection  of  the  condition  and  generation 
of  adequate  warning  signals. 

d . Develop  special  procedures  to  counter  the  hazardous  condition  and 
enhance  personnel  safety. 

e.  Residual  hazards  shall  be  those  for  which  none  of  the  above  actions 
are  effective  In  counteracting  the  hazard  and  shall  be  justified 
and  documented . 

Identified  Hazards 


Hazards  Identified  with  the  representative  orbital  propellant  logistic 
operations  baseline  are  Included  In  hazard  sheets  1 through  77.  The  variation 
to  the  baseline  where  the  tug  shares  the  delivery  function  with  the  orbltsr 
in  supporting  the  large  storage  facility  with  propellants  has  the  delta  opera- 
tions hazards  Identified  on  hazard  sheets  78  through  132.  Hazards  identified 
with  the  Booster/ESS  variation  to  the  baseline  are  contained  in  hazard  sheets 
133  through  179. 
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APPENDIX  D 
PREVENTIVE  MEASURES 

In  the  development  of  preventive  measures » the  objective  was  to  reduce 
catastrophic  and  critical  hazards  to  the  category  of  at  least  marginal  and 
preferably  negligible.  As  each  hazard  was  Identified  on  the  hazard  analysis 
sheet  (Figure  D-1) , the  steps  to  be  taken  to  reduce  the  hazard  to  an  accept- 
able level  were  detailed  In  the  "Action  Recommended"  blank.  This  "Action 
Recommended"  then  becomes  the  preventive  measures. 

This  section  opens  with  a discussion  of  the  hazard  reduction  precedence 
sequence  and  how  It  was  used  In  deriving  preventive  measures. 

In  paragraph  2 preventive  measures  are  derived  for  the  safety  critical 
operations  performed  In  space  during  propellant  logistics  operations. 

Paragraph  3 establishes  the  need  for  a manned  monitor  of  orbital 
propellant  logistics  functions,  discusses  some  of  the  data  the  monitor  must 
have  available  to  evaluate  the  progress  of  events  and  determine  when  manned 
over-ride  and  control  become  necessary. 

Paragraph  4 enumerates  the  thirty-three  residual  hazards  of  propellant 
logistics  operations,  discusses  the  factors  contributing  to  their  being 
classed  as  residuals  and  points  out  that  they  deserve  continued  emphasis 
until  they  are  reduced. 

1.  Hazard  Reduction  Precedence  Sequence 

The  study  ground  rules  stipulated  that  the  Hazard  Reduction  Precedence 
sequence  of  SPD-IA  would  be  used  in  the  reduction  of  hazard  potential. 

This  sequence  requires  that  the  major  effort  throughout  a program 
must  be  In  the  design  process.  Every  effort  must  be  made  to  prevent 
the  occurrence  of  the  hazard  by  designing  all  systems,  subsystems 
and  components  such  that  the  identified  hazard  cannot  occur. 

If  the  hazard  cannot  be  designed  out  of  the  system  and  It  Is  still 
possible  to  occur,  then  safety  devices  should  be  Incorporated  to 
counter  the  effects  of  the  hazard. 

When  a hazard  cannot  be  designed  out  of  the  system  and  safety  devices 
will  not  eliminate  the  hazard  effects,  then  warning  devices  will  be 
Incorporated  In  the  system  to  warn  the  system  operators  of  the 
occurrence  of  the  hazard. 

If  none  of  the  above  preventive  measures  will  prevent  the  occurrence 
pf  the  hazard,  then  procedures  shall  be  developed  to  operate  the 
systems  In  such  a manner  that  the  hazard  cannot  happen. 
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In  the  event  that  none  of  the  above  will  reduce  the  hazard  potential 
to  an  acceptable  level,  and  residual  hazards  remain,  program  manage- 
ment shall  be  notified  of  the  presence  of  the  unresolved  hazard. 
Management  then  has  the  option  of  modifying  the  program  direction 
to  choose  alternate,  less  hazardous  solutions,  developing  new  tech- 
nology to  counter  the  hazard,  or,  as  a least  desirable  choice,  to 
accept  the  risk  of  the  hazard. 

2.  Preventive  Measures  for  In-Space  Propellant  Logistics  Safety 
Critical  Operations 

As  a part  of  the  safety  analysis,  preventive  measures  were  developed 
for  the  safety  critical  operations  that  would  be  performed  during 
deployment,  docking,  transfer  and  retrieval.  Table  2_,1-1  is  used 
as  the  outline  for  the  concepts  and  operations  In  the  subsequent 
discussion. 

The  rows  were  Identified  "A"  through  "G"  and  the  columns  were  num- 
bered 1 through  4.  Identifier  A-2-2  would  be  the  performance  of 
"Remote  Hard  Dock  CIS  to  LSF,"  using  the  baseline  concept.  The 
hazards  attendant  to  the  execution  of  this  operation  were  listed 
and  on  the  same  horizontal  line  the  preventive  measures  were  listed 
that  should  be  performed  to  reduce  the  hazard. 

Preceding  the  preventive  measure  a letter  has  been  Included  in 
parentheses.  This  letter  Indicates  which  step  In  the  hazard  reduc- 
tion precedence  sequence  has  been  selected  as  the  preferred  method 
of  reducing  the  hazard  to  an  acceptable  level.  (D)  Indicates  that 
design  Is  the  preferred  method  of  hazard  reduction,  (S)  Indicates 
that  design  effort  will  not  reduce  the  hazard  and  safety  devices 
should  be  Incorporated,  and  (P)  Indicates  that  neither  design  nor 
safety  devices  will  reduce  the  hazard  to  an  acceptable  level  and 
that  special  procedures  must  be  employed. 

a.  A-1-1  Concept-Baseline,  Operation-Deployment  (Propellant  Tank 
Module  Deployed  by  Manipulators  from  Cargo  Bay) 

During  this  operation  the  shuttle  orbiter  has  delivered  a pro- 
pellant module  to  orbital  altitude.  The  orbiting  propellant 
depot  has  been  assembled  in  orbit  and  the  shuttle  Is  station 
keeping,  with  cargo  bay  doors  open,  ready  to  deliver  a propel- 
lant module.  Deployment  will  consist  of  those  steps  to  be 
taken  to  sever  the  Interface  of  the  module  and  shuttle  and 
remove  the  module  from  the  cargo  bay  by  the  use  of  manipulators. 
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Hazard 

(1)  Tank  rupture 

(2)  Index  probes  will  not 
release  prior  to 
deployment 

(3)  Mass  leakage  Into 
cargo  bay 


(A)  Propulsive  venting, 
leaking 


(5)  Indexing  probes  fall 
to  release  from  cargo 
bay  Interface 

(6)  QD  falls  to  seat  on 
release 

(7)  Visual  restrictions 
by  "Ice"  from  leaks 

(8)  Propellant  tank  pene- 
tration by  manipulators 
during  removal  from 
cargo  bay 


(9)  Meteoroid  penetration 

(10)  Intermittent  RCS 
operation 


(11)  Jerky  operation  of 
manipulators 

(12)  Impact  due  to  loss  of 
control  of  manipulators 


Preventive  Measure 
(S)  Pressure  relieving  devices 
(D)  Redundant  release  mechdnlsm 


(D)  Provide  redundant  valves 

(D)  Provide  retractable  shields 
for  visual  aids 

(P)  Crew  Training 

(P)  Procedures  development 

(P)  Prior  operational  checkout  of 
manipulators 

(D)  Provide  meteoroid  shield 

(D)  Redundant  RCS  controls 

(D)  Provide  RCS  accumulators  to 
Insure  propellants  available 

(P)  Verify  availability  of  RCS 
propellant 

See  A-l-l(8)  above 

(D)  Redundant  manipulator  controls 

See  A-l-l(8)  above. 


(P)  Visually  Inspect  cargo  bay 
prior  to  deorb It 

(D)  Eliminate  confined  compartments 

(D)  Provide  RCS  capability  to  over- 
come any  vehicle  Instability 

(D)  Slosh  dampeners 

(D)  Provide  redundant  release 
mechanisms 
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Hazard  Preventive  Measure 

(13)  Tank  vent  falls  In  (D)  Redundant  means  of  closing 

open  position  vents 

See  A-l-l(4)  above 

A-2-1  Concept-Baseline,  Operation-Docking  (Shuttle  Soft  Docks 
Propellant  Tank  Module  to  LSF) 

During  this  operation  the  shuttle  Is  station  keeping  with  the  LSF, 
with  the  propellant  module  on  the  extended  manipulator  ainns.  The 
manipulator  arms  will  be  used  to  soft  dock  the  module  and  rlgldlze 
the  module  to  the  LSF.  Then  the  orblter  translates  away  from  the 
LSF/module  combination.  Included  In  this  operation  Is  the  require- 
ment to  maintain  vehicle  stability  from  sloshing,  venting  or  other 
unstablllzlng  Influences  while  the  element  Is  attached  to  the 
manipulator  arms . 


Hazard 


Preventive  Measure 


(1)  Excessive  velocity  of 
soft  dock 


(D)  Limit  energy  that  can  be  Im- 
parted by  manipulators 

(P)  Crew  training 

(P)  Procedures  development 


(2)  Excessive  angular  See  A-2-1 (1)  above 

deviation  causing 
Impact 


(3)  Impact  by  space  debris  (P)  Time  launch  to  miss  debris 

detectable  by  ground  radar 

(P)  Impact  by  space  debris  for  long 
orbital  stay  time  Is  a residual 
hazard 


(4)  Loss  of  RCS 


See  A-l-l(lO)  above 


(5)  Loss  of  rlgldlzatlon  (D) (P)  RCS  system  of  passive  ele- 

ment should  be  de-energlzed  or 
tied  In  with  active  element  as 
soon  as  rlgldlzatlon  Is  complete 

(D)  Provide  redundant  capture 
latches 

(6)  Tank  vent  valve  falls  See  A-l-l(13)  above 
In  open  position 
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Hazard 


Preventive  Measure 


(7)  Attempt  to  capture 
unstable  vehicle 


(P)  Procedural  controls  should  be 
Implemented  to  prevent  capture 
of  unstable  vehicles 


A-2-2  Concept-Baseline,  Operation-Docking  (Remote  Hard  Dock  CIS 
to  LSF) 


During  this  operation  the  CIS/RHS  will  dock,  remote  from  any 
manned  assistance,  and  thus  automatically.  Of  further  signifi- 
cance Is  the  large  mass  of  both  vehicles.  Additional  considera- 
tion would  Involve  momentum  and  the  possible  excursion  of 
residual  CIS /RMS  propellants  from  one  end  of  the  tank  to  the 
other  during  the  docking  Impact.  The  passive  vehicle  Is  the  LSF; 
the  active  vehicle  Is  the  CIS/RMS. 


Hazard 

(1)  Excessive  closing  - , (D) 

velocity  causes  Impact 
damage 


Preventive  Measure 

Repetitive  operations  should  be 
automated  with  automatic  with- 
hold for  excessive  velocity 
and  angular  deviation 


(D)  Docking  controls  should  have 
backup 


(2)  Excessive  angular 
deviation  causes 
Impact  damage 

(3)  Attempts  to  dock 
unstable  vehicles 
causes  Impact  damage 


See  A-l-l(lO)  above 
See  A-2-l(l)  above 


(D)  Provide  automatic  withhold  If 
target  cannot  be  acquired 
within  design  limitations 


See  the  following  Items  for  additional  docking  preventive 
measures:  A-l-l(l),  A-l-l(4) , A-l-l(9),  A-l-l(lO),  A-2-l(2) , 

and  A-2-K5). 


A-3-1  Concept-Baseline,  Operation-Transfer  (Rotational  Accelera- 
tion of  LSF  for  Propellant  Settling  - CIS/RNS  - Orblter  Not 
Attached) 

During  this  operation  the  LSF  and  CIS/RNS  have  docked,  the 
Interface  Is  rlgldlzed  and  pre-transfer  operations  have  been 
completed.  Rotational  acceleration  will  be  Initiated  by  firing 
the  RCS  of  the  coupled  elements  to  achieve  the  necessary 
rotational  speed  to  settle  the  propellants. 
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Hazard 

(1)  Erratic  fuel  flow  to 
Gas  Generator  causes 
unstable  output 


(2)  Instability  In  Heat 
Exchanger 


(3)  Structural  failure 
due  to  vehicle 
Instability 


(4)  Propellant  leakage 
causes  explosive 
mixture 

(5)  Failure  of  relief  valve 
In  closed  position 
causes  burst  disc 
rupture 

(6)  Thermal  shock  because 
of  rapid  chllldown 

(7)  Dynamic  loading  of 
Joints  and  Interfaces 


Preventive  Measure 

(D)  Provide  GG  accumulators  to 
insure  propellants  available 

(D)  Provide  strainers  or  filters 
to  prevent  contamination  from 
blocking  orifices 

(D)  Provide  redundant  fuel  controls 

(D)  Provide  slosh  dampeners  to 
reduce  vapor  pull-through 

(D)  Provide  anti-vortex  devices  to 
reduce  vapor  pull-through 

(P)  Proof  test  Heat  Exchanger 

(S)  Provide  GG  over-temperature  or 
over-pressure  and  Instability 
correction 

See  A-3-l(l)  above 

(D)(P)  See  A-2-l(5) 

(D)  Slosh  dampeners 

(D)  RCS  should  correct  Instability 
of  vehicles  under  any  dynamic 
conditions 

(D)  Eliminate  confined 
compartments 

(D)  Redundant  relief  valve 

(D)  See  A-l-l(4)  above 


(D)  Automatic  withhold  If  lines/ 
tanks  not  down  to  temperature 

(D)  Provide  rlgldlzatlon  fixture 
that  will  resist  vehicle 
instability 

(D)(P)  See  A-3-K3)  above 
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Hazard  Preventive  Measure 

(8)  Unable  to  shutdown  (D) (P)  See  A-3-l(3) 

and  desplh  due  to 

vehicle  Instability  (D) (P)  See  A-l-l(lO) 


(9)  Wobble  during  fluid 
transfer 


(D)(P)  See  A-3-K3) 


See  the  following  Items  for  additional  transfer  preventive 
measures:  A-l-l(4),  A-l-l(7),  and  A-l-l(9). 


e.  A-4-1  Concept-Baseline,  Operation-Retrieval  (Propellant  Tank 
Retrieval  Placement  In  Cargo  Bay  and  Deorblt  of  Orblter) 


During  this  operation  the  orblter  will  station  keep  with  the 
stable  LSF,  remove  the  empty  module  from  the  LSF,  translate 
away,  position  the  module  In  the  cargo  bay,  make  necessary 
verification  tests,  close  the  doors  and  deorblt.  The  stability 
of  the  module  while  on  the  manipulator  arms  and  the  Influence 
of  residual  propellants  Is  of  concern. 

Hazard  Preventive  Measure 


(1)  Propellant  leakage 

causes  "Ice"  on  module 
or  cargo  bay  walls 
leading  to  fire/ 
explosion 


(P)  Conduct  visual  Inspection  of 
cargo  bay  and  module 

(P)  Defer  re-entry  until  "Ice" 
has  sublimed 


(2)  Negative  pressure  In 
module  tanks  causes 
Imploslon/f Ire/ 
explosion 


(P)  Do  not  deorblt  any  tank  that 
cannot  be  verified  to  be 
within  structural  limits  of 
atmospheric  pressure 


(3)  Venting  Into  cargo  bay 
during  re-entry 


(D)  Provide  closed  venting  system 
from  module  through  shuttle 
to  ambient 


(P)  Leak  check  shuttle/module  vent 
Interface  prior  to  de-orblt 


(4)  Improper  stowing  of 

module  leads  to  shifting 
and  tank  rupture 


(D)  Each  shuttle  cargo  should  be 
provided  with  rigid  tie-down 

(P)  Verify  tie-down  rlgldlzed  prior 
to  deorblt 


(5)  Failure  of  Indexing  (D)  See  A-l-l(5) 

probes  to  release 
prior  to  undocking 
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Hazard  Preventive  Measure 

(6)  Any  conditions  of  (D) (P)  Same  as  conditions  developed 

Impact  which  cause  under  deployment  operations 

penetration  of  module 
propellant  system' 

See  the  following  Items  for  additional  retrieval  preventive 
measures:  A-l-l(4),  A-l-l(6),  A-l-l(7),  andA-2-l(l). 

f.  B-2-1  Concept-Orblter/Tug/LSF,  Operation -Docking  (Remote  Hard 
Dock  Tug/Module  to  LSF) 

The  new  elements  that  have  been  added  In  this  operation  are  the 
remote  automatic  docking  of  a small  mass  (tug)  to  a large  mass 
(LSF) . 


Hazard  Preventive  Measure 

(1)  Docking  Impact,  small  (D)  Docking  mechanism  must  be 

mass  to  large  mass  capable  of  absorbing  momentum 

of  docking  between  large  and 
small  vehicles  to  minimize 
dynamic  instability  in  either 
vehicle 

See  A-2-1  and  A-2-2  for  other  docking  preventive  measures. 

g.  C-2-1  Concept-Booster/ESS/Large  Propellant  Tank.  Operation- 
Remote  Hard  Dock  Tug/Modulate  LSF  (Remote  Hard  Dock  of  Large 
Propellant  Tank  with  CIS/RNS) 

During  this  operation  the  added  operation  Is  the  remote,  auto- 
matic docking  of  a large  tank  with  the  CIS/RNS  after  having  been 
boosted  by  the  ESS. 

See  B-2-1  for  docking  preventive  measures. 

h.  D-3-1  Concept-Orblter  to  Orbiter  Operation  - Transfer  (Flex  Lines 
Used  by  Attaching  at  QD  with  Use  of  Manipulators) 

During  this  operation  the  additional  elements  that  have  been 
added  are  the  station  keeping  of  two  orbiters  and  the  use  of 
manipulators  to  hook  up  flex  lines  In  preparation  for  propellant 
transfer. 
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Preventive  Measures 
(P)  See  A-1-K8) 


Hazard 

(1)  TPI  damaged  on  removal 
or  replacement  by 
manipulators  leading 
to  fire /explosion  on 
shuttle  re-entry 


(2)  QD  leaks  on  hook-up 


(3)  QD  leaks  on  release 

(A)  QD  hangs  up  on 

attempting  to  release 

(5)  Long  flex  line  becomes 
fouled  when  paid  out 
and  ruptures  line 

(6)  Flex  line  ruptures  and 
whips,  damaging 
orblter/orblters 


(7)  Freezing  of  propellants 
in  long  (70*)  flex  lines 


(P)  Perform  visual  inspection  of 
TPI  after  replacement 

(P)  Delay  re-entry  until  TPI  is 
repaired/replaced 


(D)  Provide  back-up  release 
mechanism 

(D)  Provide  reels  for  flex  line  or 
other  devices  to  minimize 
fouling 

(D)  Provide  Isolation  valve  in 
supplier  line 

(D)  Provide  supports  at  Intervals 
on  manipulator  arm 

(D)  Provide  heaters  on  flex  lines 


(D)(P)  See  A-1-K7) 

(D)  Eliminate  confined 
compartments 

(D)  Provide  back-up  valve 


See  A-1-1  for  other  deployment  preventive  measures. 

See  A-2-1  and  A-2-2  for  other  docking  preventive  measures. 
See  A-3-1  for  other  transfer  preventive  measures. 

See  A-A-1  for  other  retrieval  preventive  measures. 


D-3-2  Concept-Orbiter  to  Orbiter.  Operation-Transfer  (Positive 
Displacement  Method  used  for  Propellant  Transfer) 


The  added  element  during  this  operation  is  the  use  of  positive 
expulsion,  bladders  or  bellows,  to  transfer  propellants. 

Hazard  Preventive  Measure 

(1)  Rupture  at  diaphragm  (D)  Provide  pressure  relieving 

or  bellows  by  excessive  devices 

pressure 
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Hazard 


Preventive  Measure 


(2)  Leakage  of  both 
propellants  Into 
common  pressurizing 
gas  source,  leading 
to  f Ire/exploslon 


(D)  Provide  redundant  Isolation 
between  common  source  and 
propellant  cavities 


See  D-3-1  for  other  preventive  measures  dealing  with  transfer 
by  flex  lines. 

j . E-1^1  Goncept-Orblter  to  Tug,  Operation-Deployment  (Propellant 

Tank  Module  Deployed  by  Rotational  Deployment  Mechanism) 


During  this  operation  the  Introduction  of  rotational  devices 
was  made  to  deploy  a propellant  module  out  of  the  cargo  bay  of 
the  shuttle.  An  Item  of  concern  is  the  lateral  stability  of 
the  module  while  being  rotated  out  of  the  cargo  bay. 


Hazard 


Preventive  Measure 


(1)  Rotational  mechanism 
jams  with  module 
partially  deployed 


(D)  Provide  redundancy  in 
rotational  mechanism 

(D)  Provide  means  to  release 

drive  mechanism  and  complete 
deployment  by  manipulators 


See  A-1-1  for  additional  deployment  preventive  measures. 


k.  E-3-1  Concept-Orblter  to  Tug,  Operation-Transfer  (Rotational 
Acceleration  for  Propellant  Settling  with  Orblter  Attached) 


For  this  operation  the  orblter  remains  attached  to  serve  as  a 
counterweight  while  transferring  propellants  from  a module  to 
a tug.  Of  significance  Is  the  fact  that  the  orblter  crew  will 
remain  relatively  Inactive  for  long  periods  (ten-hour  transfer 
time) , and  will  be  subject  to  any  Instability  Introduced  by 
the  assembly  that  might  be  detrimental  to  human  performance. 


Hazard 

(1)  Because  of  failure  on 
tug  or  method  of  opera- 
tion of  tug  the  man  rating 
of  the  orblter  Is 
compromised 

(2)  Long  period  of  rotation 
degrades  man's  reaction 


Preventive  Measure 

(D) (P)  No  attached  element  will 
degrade  the  man  rating  of  the 
manned  element  either  by  design 
or  operation. 


(P)  Procedures  will  be  developed 
to  Insure  rest  and  food  to 
retain  man's  capability 
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Hazard  Preventive  Measure 

(3)  Control  failure  will  (D)  Provide  redundancy  in  critical 

Introduce  excessive  RCS  controls 

rotational  speeds  and 
degrade  man's  control 
capability 

See  A-3-1  for  other  rotational  acceleration  preventive  measures. 

l . E-3-2  Concept-Orbiter  to  Tug>  Operation-Transfer  (Linear 
Acceleration  for  Propellant  Settling  with  Orbiter  Attached) 

Linear  acceleration  of  the  orblter/module/tug  combination  is 
Introduced  in  this  combination.  Again  the  orbiter  crew  will  be 
relatively  Inactive  for  ten  hours  and  will  be  subject  to  any 
instability  introduced  by  the  assembly  that  might  be  detrimental 
to  htiman  performance. 

Hazard  Preventive  Measure 

(1)  RCS  failure  because  of  (D)  To  provide  the  continuous 
long-term  usage  thrust  required  for  linear 

acceleration  consideration 
should  be  given  in  the  design 
process  for  low-thrust  engines 
other  than  RCS,  since  the  RCS 
may  not  have  continuous 
operation  as  a design  require- 
ment 

See  A-3-1  for  other  transfer  preventive  measures. 

m.  F-2-1  Concept-Orbiter  to  CIS/RNS,  Operation-Docking  (Orbiter 
Hard  Docks  Propellant  Tank  Module  to  CIS/RNS) 

During  this  operation  the  orbiter  will  be  required  to  station 
keep  with  a modular  CIS,  remove  a module  from  the  cargo  bay  and 
soft-dock  it  to  the  CIS,  rigldlze  the  module  and  translate  away. 

Hazard  Preventive  Measure 

(1)  Compromise  of  orbiter  (D) (P)  See  E-3-l(l) 
man  rating 

See  A-2-2  and  B-2-1  for  other  docking  preventive  measures. 
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n.  F-3-1  Coneept-Orblter  to  CIS/HNS , Operation-Transfer  (Linear 
Acceleration  for  CIS/RMS  Tank  Module  Propellant  Settling  with 
Orblter  Not  Attached) 

In  this  operation  a large  vehicle  (CIS/RNS)  and  a small  vehicle 
(module)  will  be  linearly  accelerated  for  the  propellant  transfer 
(ten  hours)  with  continuous  thrusting  from  small  engines.  In  an 
unmanned,  automatic  mode. 

See  E-3-2  for  linear  transfer  preventive  measures. 

o.  F-3-2  Coneept-Orblter  to  CIS/RNS,  Operation-Transfer  (Capillary 
Fluid  Control  for  CIS/RNS  Tank  Module  Propellant  Transfer) 


During  this  operation  the  concept  of  propellant  settling  by  the 
use  of  capillary  devices  is  Introduced. 

Hazard  Preventive  Measure 


(1)  Structural  failure  of  (D) 
capillary  devices 


(2)  Premature  wetting  of  (D) 

self  wlcklng  screen 
reduced  capability 

(D) 


(3)  Heat  leaks  reduce  (D) 

effectlvlty  due  to 
propellant  boiling 

See  A-3-1  and  E-3-1  for  other  tra 


The  design  process  should  pro- 
vide structural  Integrity  of 
screens  while  fluid  Is  sloshing . 
or  when  struck  by  solid  particles 
and  resist  buckling  when 
clogged  by  contaminating  solid 
particles 

The  design  process  should 
minimize  premature  wetting  by 
baffles 

Excessive  flow  should  be 
eliminated  to  prevent 
geyserlng 

Prior  to  propellant  transfer 
a visual  Inspection  should  be 
made  of  Integrity  of  Insulation 

isfer  preventive  measures. 


p.  G-1-1  Coneept-Orblter  to  Modular  CIS,  Operation-Deployment 

(Propellant  Tank  Module  Deployed  by  Rotational  and  Manipulator 
Mechanisms) 


This  mode  of  operation  Introduces  the  deployment  of  numerous 
loaded  propellant  modules  to  be  used  In  building-block  fashion 
to  make  up  a full  CIS  propellant  load 

See  A-1-1  for  manipulator  deployment  preventive  measures. 

See  E-1-1  for  rotational  deployment  preventive  measures. 
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Monitoring  Devices 

It  is  visualized  that  a concept  as  complex  as  providing  propellant 
for  the  space  program  through  1990  could,  conceivably,  be  made  fully 
automatic  with  no  intervention  by  man  being  required.  At  this  time 
the  prime  delivery  element  is  the  shuttle  orbiter  which  is  largely 
under  manual  control.  Other  manual  operations,  such  as  space 
maintenance,  have  been  considered  to  be,  if  not  an  Integral  factor 
in  propellant  logistics  operations,  at  least  an  option  to  be  used, 
if  necessary. 

When  manual  operations  are  integrated  into  any  automatic  operation 
it  imposes  the  requirement  of  providing  another  manual  operation, 
that  of  monitoring  the  progress  of  events.  Even  if  no  manual  opera- 
tions were  contemplated  in  propellant  logistics  operations,  it  is 
visualized  that  at  least  mission  completion  would  be  a necessary 
function  to  be  monitored.  Furthermore,  even  fully  automatic  opera- 
tions, regardless  of  the  level  of  redundancy  can  fall  and  trouble 
shooting  data  is  necessary  for  human  Intervention,  analysis  and 
corrective  action. 

In  establishing  the  necessity  for  a monitor  to  be  aware  of  the 
progress  of  orbital  events,  a manned  ground  station  becomes  necessary, 
since  a manned  element  (orbiter)  is  not  always  present.  When  an 
orbiter  is  present  in  the  vicinity  of  orbital  propellant  logistics 
operation,  however,  the  crew  should  be  provided  with  the  status  of 
such  operations  as  to  be  capable  of  assuming  control  since  they  are 
closer  to  the  operation  in  progress.  Contradictory  commands  should 
be  eliminated  by  procedures  when  two  manned  elements  have  control 
capability  and  ground  control  should^defer  to  orbital  control  when 
orbital  control  is  possible. 

To  acquire  the  necessary  data  to  permit  the  monitor  to  be  able  to  be 
effective,  the  design  process  should  consider  the  provision  of 
monitoring  devices  to  include  the  following: 

Electrical  power  - Voltage  and  current  levels  of  electrical 
power  and  whether  operating  on  primary  or  reserve  supplies. 

Pneumatic  supply  - The  pressure  level  of  the  pneumatic  supply 
will  be  needed  to  evaluate  the  ability  to  complete  subsequent 
missions. 

Valve  position  indicators  - The  open  or  closed  indication  of 
valves  that  are  operated  during  a planned  event. 

Propellant  tank  pressure  and  temperature  - A readout  of  the 
propellant  tank  pressure  and  temperature  will  be  required  to 
evaluate  propellant  usage  and  leakage,  at  a minimum. 

Propellant  gauging  - The  quantity  of  propellants  in  the  supplier 
and  user  tanks  should  be  available. 
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Operating  cycles  - A means  of  recording  the  number  of  operating 
cycles  of  limited  life  components. 

Leak  check  - Provide  a means  to  verify  that  all  possible  sources 
are  free  of  leaks . 

Line  Interconnect  fixture  rlgldlzatlon  - A method  of  verifying 
that  the  Interface  between  elements  has  been  securely  mated. 

Docking  latches  - The  captured  or  released  status  of  docking 
latches  should  be  available. 

Redundant  system  status  - The  operational  level,  whether  on 
primary  or  reserve,  should  be  available. 

Hazardous  Gas  Concentration  - Flammable  gas  detectors  should  be 
provided  for  all  restricted  compartments  (such  as  cargo  bay)  for 
ground  operations. 

Fire  Detectors  - Fire  detectors  should  be  provided  for  all 
restricted  compartments  (such  as  cargo  bay)  for  ground  operations. 

Life  support  system  operational  level  - For  manned  operations 
the  operational  levels  of  LSS  fluids,  and  the  presence  of  toxic 
gases  should  be  provided  to  the  crew  being  supplied. 

Space  debris  warning  - Since  Impact  by  space  debris  Is  a residual 
hazard,  collision  warning  devices  should  be  given  consideration. 

The  above  listed  monitoring  devices  would  provide  the  Control  Monitor 
with  the  operational  status  of  orbital  operations.  Intervention  at 
critical  stages  Implies  the  communication  of  data  during  these 
critical  stages.  Further  study  would  be  necessary  to  fully  define 
the  operational  capability  of  the  communications  systems. 

4.  Residual  Hazards 

In  the  application  of  the  Hazard  Reduction  Precedence  Sequence  to 
reduce  hazards  design  effort,  safety  devices,  warning  devices  and 
special  procedures  are  used.  If  the  application  of  these  measures 
does  not  reduce  the  hazard  level  to  an  acceptable  degree,  then 
these  hazards  are  residual  ones.  For  the  purposes  of  this  study, 
only  those  hazards  that  were  categorized  as  catastrophic  or  critical 
were  considered.  For  the  purposes  of  this  study  then,  those  hazards 
that  remain  at  the  level  of  catastrophic  or  critical  after  the 
application  of  the  recommended  preventive  measures  are  residual 
hazards . 

The  residual  hazards  are  Identified  on  the  Hazard  Analysis  sheet 
(Appendix  C)  In  the  "Hazard  reduced  to"  blank.  If  the  hazard  remains 
listed  as  catastrophic  or  critical  In  this  blank.  It  Is  a residual 
one. 


- 511  - 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


For  the  convenience  of  the  reader,  the  orbital  operations  residual 
hazards  are  discussed  below: 

H/A  #14,  102,  153  - Meteoroid  Impact  - The  Impact  by  hyper 
velocity  meteoroids  that  could  cause  loff  of  life  or  mission 
and  cannot  be  avoided. 

H/A  if21  - EVA  Operations  - EVA  remains  a safety  critical  opera- 
tion because  of  the  lack  of  redundancy  of  LSS. 

H/A  , 87  - Propellant  Quantity  - The  lack  of  knowledge  of 
the  quantity  of  propellants  for  mission  completion,  RCS  action 
and  orblter  landing  weight  could  result  In  loss  of  mission, 
orblter  or  crew  and  remains  a residual  hazard. 

H/A  i?52,  118,  120,  121,  161  - Disturbances  - Overall  vehicle 
dynamics  Is  critical  to  the  success  of  propellant  logistics 
operations  and  any  factor  that  could  lead  to  the  loss  of 
stability  Is  a residual  hazard. 

H/A  j?68,  73  - Propellant  Venting  Into  Cargo  Bay  - The  accumulation 
of  4%  hydrogen  in  the  cargo  bay  would  be  catastrophic  to  the 
orblter  and  crew.  By  the  use  of  the  recommended  preventive 
measures  the  hazard  remained  critical. 

H/A  07A  - Propellant  Leakage  Into  Cargo  Bay  - The  accumulation 
of  4%  hydrogen  could  lead  to  the  loss  of  the  orblter  and  crew. 
Undetected  leakage  from  any  cause  Is  a residual  hazard. 

H/A  if 7 6 - Hard  Landing  - The  landing  weight  at  the  shuttle 
cargo  Is  limited  to  40K  lbs.  The  requirement  to  achieve  this 
weight  as  applied  to  propellant  logistics  elements  Is  critical 
to  the  orblter  and  crew. 

H/A  if80,  133  - Negative  Pressure/Mass  Spill  - Tank  Implosion 
would  be  likely  to  introduce  combustible  gases  Into  the  cargo 
bay  and  be  catastrophic  to  the  orblter  and  crew.  The  application 
of  the  preventive  measures  would  reduce  this  hazard  to  critical. 

H/A  096,  99,  107  - Docking  Hazards  - The  control  of  the  orblter 
Is  largely  manual  and  docking  and  separation  maneuvers  remain 
a critical  operation. 

H/A  #97  - Docking  Between  Unstable  Vehicles  - Errors  of  judgement 
during  a manual  docking  maneuver  could  Introduce  critical  hazards 
when  either  or  both  of  the  vehicles  are  unstable. 

H/A  #101  - Systems*  Failure  During  Rendezvous  - A failure  in  any 
one  of  the  several  systems  that  are  Involved  could  Introduce 
critical  hazards. 
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H/A  //102  - Space  Debris  - The  Impact  of  space  debris  remains  as 
a catastrophic  hazard. 

H/A  //115  - Reduction  of  Vision  - The  provision  of  retractable 
shields  to  reduce  the  formation  of  "Ice"  on  visual  aids  reduces 
the  hazard  from  catastrophic  to  critical.  The  finite  reaction 
time  for  the  operator  to  actuate  the  controls  still  leaves  the 
chance  that  some  clouding  would  occur  and  results  in  a critical 
hazard. 

H/A  //126  - Failure  of  Release  Mechanisms  - Provision  of  a 
means  to  notify  operator  that  release  mechanisms  are  unlocked 
and  free  does  not  prevent  human  error  from  attempting  to  trans- 
late with  one  or  more  latches  still  engaged  and  hazard  remains 
critical. 

H/A  //131,  132  - Loss  of  Attitude  Control  - The  loss  of  attitude 
control  from  any  source  remains  a critical  hazard. 

H/A  //1A7  - Loss  of  Thrust  on  ESS  - The  fact  that  a single  order 
failure  exists  in  the  ESS  (S-II)  vent  valves  Is  known  and 
accepted  for  the  S-II  vehicle.  It  must  remain  a critical  hazard 
for  the  ESS,  however, 

H/A  //148  - Reduced  Integrity  of  Pressurization  System  - The  fact 
that  both  vent  valves  are  commanded  to  low  mode  with  a single 
electrical  signal  Is  accepted  on  the  S-II  Program.  It  must 
remain  a critical  hazard  for  the  ESS,  however. 

H/A  <*160,  17A,  175^  176  - ESS  Footprint  - The  deorbit  of  an  ESS 
with  a fully  loaded  propellant  module  could  have  catastrophic 
results  In  populated  areas.  The  choice  of  the  footprint  and 
the  achievement  of  this  footprint  remains  a critical  hazard. 

The  above  listed  33  residual  hazards  have  been  Identified  during 
the  course  of  the  hazard  analysis.  The  possible  preventive  measures 
that  could  be  applied  did  not  reduce  the  hazard  potential  to  an 
acceptable  level.  Continued  effort  should  be  applied  to  the 
reduction  of  these  hazards.  As  a propellant  logistics  Is  defined 
and  Implemented,  new  technology  that  becomes  available  In  the 
Intervening  time  should  be  applied  to  hazard  reduction. 
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APPENDIX  E 
SAFETY  CRITERIA 

System  Safety  criteria  was  developed  at  the  initiation  of  the  study  for 
use  in  establishing  the  proper  perspective  for  safety  requirements.  This 
criteria  was  followed  by  safety  criteria  for  use  in  slush  utilization  con- 
siderations. 

Propellant  transfer  alternatives  were  considered  in  the  ISPLS  study, 
and  the  effort  was  supported  with  System  Safety  criteria  for  application  to 
the  alternatives  considered. 

System  Safety  Criteria  for  ISPLS  Study 

1.  Propellant  logistic  elements  which  are  designed  for  automatic  remote 
operation  shall  include  provisions  for  space  crew  operations  support 
in  an  activation,  emergency  or  maintenance  operational  mode. 

2.  Orbital  Propellant  Logistics  System  elements  shall  provide  a habit- 
able environment  in  all  areas  designated  for  frequent  onboard 
maintenance  activities. 

3.  Internal  areas  of  Logistics  System  elements  which  may  require  un- 
scheduled maintenance  activities  shall  be  accessible  for  suited  IVA. 

A.  No  in-orbit  maintenance  shall  be  conducted  inside  of  orbiting 
propellant  storage  tankage.  ' 

3.  Where  the  shuttle  orbiter  is  hard  docked  to  a propellant  depot 
element,  the  stability  of  the  entire  configuration  shall  be  such 
as  to  preclude  disturbances  which  are  detrimental  to  the  orbiter 
crew  members  during  preparations  for  propellant  transfer  operations. 

6.  For  those  malfunctions  and/or  hazards  which  may  result  in  time- 
critical  emergencies,  provisions  shall  be  made  for  automatic  switch- 
ing to  a safe  mode  of  operation  and  for  alerting  and  warning  per- 
sonnel of  the  malfunction  within  the  system. 

7.  Any  operational  mode  of  logistic  propellant  elements  in  which  pro- 
pellant tankage  is  opened  to  space  vacuum  environment  shall  incorpor- 
ate a provision  for  tank  pressurization  when  the  tank  is  to  be 
returned  to  earth  in  the  shuttle  orbiter. 

8.  Provisions  shall  be  incorporated  in  all  orbital  propellant  logistic 
elements  to  measure  the  quantity  of  propellants  transferred  into  or 
removed  from  storage  elements  and  the  number  of  pressure  cycles 
imposed  on  the  pressurized  tank. 
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9.  propellant  module  damaged  to  the  extent  that  leakage  of  propel- 

lants could  be  expected  to  occur  in  the  shuttle  orblter  cargo  bay 
upon  re-entry,  shall  not  be  returned  to  earth  by  the  orblter. 

10.  EVA  shall  be  conducted  either  by  using  the  "buddy"  system  or  within 
visual  range  of  a suited  crewman  acting  as  a safety  backup. 

11.  Propellant  modules  which  have  sustained  meteoroid  impact  but  have 
self  sealed  due  to  Ice  plus  formation  shall  not  be  returned  to  earth 
in  the  shuttle  cargo  bay  unless  repairs  can  be  effected  prior  to 
placement  In  the  shuttle  orblter  cargo  bay. 

12.  Hazardous  operations  during  Initial  system  checkout  In  space  shall 

be  accomplished  from  a remote  location  prior  to  exposure  of  operating 
or  maintenance  crews. 

13.  Interfaces  which  Involve  mating  by  Indexing  and  rlgldlzatlon  between 
logistic  elements  for  the  purpose  of  propellant  transfer,  shall  be 
capable  of  separating  under  conditions  where  the  rlgldlzlng  fixture 
falls  to  release  under  normal  separation  conditions. 

14.  Propellant  logistic  elements  shall  preclude  the  possibility  of  In- 
advertent activation  of  critical  systems  through  design  considera- 
tions and  use  of  protective  devices. 

15.  Capability  shall  be  provided  for  performing  critical  functions  at 

a nominal  level  with  any  single  component  failed  or  with  any  portion 
of  a subsystem  Inactive  for  maintenance. 

16.  The  Propellant  Logistic  System  operations  shall  be  conducted  to  pre- 
planned procedures.  Safety  Critical  procedures  shall  be  approved  by 
System  Safety  Engineering,  Engineering  and  Flight  Operations. 

17 . Vent  systems  design  shall  preclude  the  buildup  of  Ice  in  a manner 
that  could  restrict  the  flow  of  vented  fluids. 

18.  At  least  two  paths  of  emergency  egress  shall  be  provided  In  any 
passage,  compartment  or  propellant  logistic  element  that  Involves 
the  human  element  In  space. 

19.  Ground  operations  Involving  the  transfer  of  Slush  H2,  LH2  or  GH2 
shall  be  considered  Safety  Critical.  The  requirements  for  facilities 
design  of  emergency  off-loading  and  venting  systems  shall  take 
precedence  In  any  cost  trade. 

20.  The  loss  of  the  stabilization  system  In  an  "in-space"  propellant 
logistic  element  shall  be  cause  for  mandatory  and  automatic  with- 
holding of  docking  privilege  for  the  purpose  of  propellant  transfer. 

21.  The  propellant  modules  or  other  propellant  containers  carried  in  the 
shuttle  orblter  cargo  bay  shall  be  configured  such  as  to  preclude 
venting  Into  the  cargo  bay. 
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22.  Handling  devices  for  IVA  transfer  of  propellant  modules  shall  pre- 
clude the  hazard  of  Impact  damage  to  the  module  through  design  of 
restraint  provisions  limiting  movement  within  the  cleared  access 
corridors. 

23.  Line  segments  shall  be  capable  of  Isolation  and  provided  with  drain 
and  purge  capability  for  maintenance  functions.  Segments  of  lines 
which  are  locked  up  such  as  to  entrap  fluids  shall  Incorporate 
pressure  relieving  provisions  to  prevent  line  rupture. 

24.  Where  artificial  "G"  Is  employed  by  rotational  means,  redundant 
means  for  stopping  the  rotational  movement  shall  be  provided. 

25.  Crew  operations  requiring  EVA  for  maintenance  or  emergency  repair 
shall  be  supported  In  the  propellant  logistic  element  design  with 
handrails  or  other  provisions  for  securing  a firm  position  during 
the  operation. 

26.  Traffic  patterns  to  a large  storage  facility  (LSF)  shall  be  pre- 
planned and  controlled.  No  approach  or  docking  shall  be  made  outside 
the  radiation  protection  cone,  when  the  RNS  Is  docked  to  the  LSF. 

27.  Each  propellant  logistic  element  shall  provide  a compatible  con- 
figured means  for  grounding  the  Interface  and  element  with  docking 
elements  to  equalize  the  electrical  potential  of  the  configuration 
prior  to  transfer  of  propellants. 

System  Safety  Criteria  for  Hydrogen  Slush  Utilization 

1.  Consider  the  quantity  distance  requirements  for  explosive  over- 
pressures In  computing  the  line  distances  for  slush  transfer  betwee^n 
the  facility  and  pad. 

2.  Emergency  off  load  requirements  of  slush  via  transfer  lines  or  the 
off  loading  of  the  propellant  module  should  be  a positive  considera- 
tion In  all  cost  assessments  (facilities,  operations)  for  the  cases 
of  emergencies  and  pad  abort  operations. 

3.  Where  the  propellant  module  is  utilized  with  approximately  100%  of 
the  volume  loaded  with  slush,  consideration  of  possible  two-phase 
flow  In  the  pad  vent  system  should  be  programmed  in  slush  utilization 
considerations . 

4.  Any  transfer  operation  Involving  slush  shall  be  capable  of  Insuring 
the  flow  through  the  transfer  lines  exceeds  the  critical  velocity  at 
all  times. 

5.  In  the  ground  loading  of  propellant  modules,  the  facility  must  be 
capable  of  measurement  of  the  solid  fraction  of  slush  propellants 
entering  the  tankage,  to  assure  sufficient  ullage  volume  to  compen- 
sate for  Increased  volume  due  to  heat  leaks. 
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6.  Since  slush  has  the  potential  for  destroying  the  functional  capabili- 
ty of  capillary  screens,  the  effect  of  this  hazard  shall  be  assessed 
against  the  propellant  leveling  devices  replacing  the  screens. 

7.  Consider  the  effect  on  Internal,  tank  conponents  such  as  screens, 
baffles,  sensors,  etc.,  for  the  case  of  slug  flow  discharging  Into 
the  propellant  tank  as  a result  of  heat  leaks  during  flow  Interrup- 
tion. 

8.  Consider  flow  Interruption  as  a possibility  in  slush  transfer 
operations  by  pump  or  pressure  loss. 

9.  Consider  the  condition  which  could  occur  if  purge  pressure  to  the 
HPI  Insulation  Is  lost  while  the  propellant  module  is  Installed  in 
the  orblter  cargo  bay,  and  the  emergency  equipment  necessary  for 
recovery. 

Propellant  Transfer  Options  Safety  Criteria 

The  selection  of  transfer  alternatives  being  considered  by  Project  I for 
llquld/vapor  Interface  control  was  supported  with  System  Safety  criteria. 

The  criteria  Is  as  follows: 

1.  Llquld/Vapor  Interface  Control 

In  the  selection  of  the  type. of  llquld/vapor  interface  control  to 
be  accepted,  the  following  safety  considerations  shall  be  utilized 
In  the  selection  process. 

a.  Rotational  Method 

(1)  The  method  shall  consider  the  configuration  and  combinations 
of  modules  (add  ons  such  as  equipment  module,  LOX  module, 
etc.)  that  will  be  docked  and  the  potential  hazards  of  CG 
excursion.  Introducing  a wobble  In  the  rotational  plane 
during  transfer  of  fluids. 

(2)  The  method  shall  consider  the  disturbance  Induced  by  coupling 
of  the  vehicle  and  propellant  dynamics  (sloshing)  and  the 
sensitivity  of  the  RCS/stablllzation  sensing  system  to  cope 
with  the  coupling  disturbance  of  the  various  coupled  con- 
figurations under  normal  and  off  design  conditions  of  RCS 
operation. 

(3)  The  Integrity  of  the  system  shall  include  the  capability  to 
assure  the  supply  Inlet  shall  be  covered  by  fluid  under 
sloshing  conditions. 

(4)  The  rate  of  transfer  of  propellants  shall  consider  the  effect 
of  laminar  flow  of  propellants  Into  the  propellant  tank,  the 
sloshing  created,  and  d3mamics  Imparted  to  the  configuration. 
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(5)  The  vehicle  and  propellant  dynamic  coupling  during  spin  down 
of  the  configuration  shall  be  considered  for  disturbance 
effects  on  the  structural  members. 

(6)  The  time  for  emergency  shutdown  and  splndown  shall  be  con- 
sidered for  the  case  where  a line  rupture  occurs  at  the  line 
Interconnect  fixture,  between  transfer  tanks. 

(7)  The  effects  of  propellant  tank  venting  during  rotational 
transfer  shall  be  Investigated  for  potential  hV  Introduction 
In  an  adverse  thrust  vector. 

(8)  During  configuration  rotation,  no  attached  vehicle  or  module 
shall  be  manned. 

b.  Linear  Acceleration  Method 

(1)  The  capability  of  the  RCS  to  provide  a stabilized  configura- 
tion during  linear  acceleration  along  the  longitudinal  axis 
shall  be  such  as  to  stabilize  the  configuration  over  the 
entire  CG  shift  range  during  the  transfer  operation. 

(2)  Disturbances  caused  by  sloshing  or  laminar  flow  Injection 
Into  the  receiver  tank  shall  be  considered  for  effects  on 
the  vehicles  at  Initiation  of  transfer  operations. 

(3)  Venting  characteristics  of  the  configuration  during  accelera- 
tion shall  ensure  an  adverse  AV  thrust  vector  Is  not  Imparted 
to  the  configuration. 

(4)  The  purging  of  fluids  from  transfer  lines  shall  be  accom- 
plished during  the  acceleration  mode. 

(5)  Emergency  termination  of  the  propellant  transfer  shall  be 
considered  for  the  case  where  a failure  occurs  at  the  line 
Interconnect  fixture. 

c.  Capillary  Barrier  Method 

(1)  Provide  a means  for  preventing  boiling  In  the  capillary 
channels  which  will  disrupt  the  flow  of  liquid. 

(2)  The  sloshing  of  propellants  during  re-fllllng  may  wet  a 
self-wlcklng  screen,  trapping  any  Initial  gas  within  the 
compartment.  Safety  consideration  requires  removal  of 
trapped  gasses. 

(3)  In  assessing  this  method  of  llquld/vapor  Interface  control, 
not  only  the  effect  of  vapor  control  In  the  Installed  system 
must  be  considered,  but  also  those  effects  and  Impact  on  the 
user  vehicle  for  a full  complement  of  capillary  devices  must 
be  considered,  where  It  Is  necessary  to  assure  venting  of 
gas  for  thermodynamic  control. 
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(4)  Consider  the  effect  of  propellant  transfer  slug  flow  and  the 
effect  of  the  flow  on  the  capillary  devices. 

(5)  This  system  Is  considered  unusable  and  unsafe  In  the  case 
where  slush  hydrogen  la  to  be  used  In  the  tankage. 

2.  Receiver  Tank  Thermodynamic  Control 

a.  Any  tank  thermodynamic  control  system  shall  Include  as  a part 
thereof,  a tank  pressure  relief  system  through  which  tank 
pressures  can  be  vented  automatically,  by  use  of  a vent  valve, 
to  maintain  correct  tank  pressure. 

b.  In  considering  the  case  of  venting  to  space,  the  effects  of  the 
vented  fluid  on  operations  In  the  area  shall  be  such  as  to 
present  no  adverse  effect  on  the  operating  systems,  such  as 
fogging  TV  lens,  obscuring  the  area  with  Ice  crystals,  etc. 

3.  Expulsion 

a.  In  selection  of  the  expulsion  system,  consideration  of  the  rate 
of  transfer  vs.  type  of  artificial  "g"  application  should  be 
evaluated  for  disturbance  factors  and  CG  mlgratlon/osclllatlon 
due  to  entry  port  location,  laminar  flow  within  the  tank  and 
rate  of  fluid  entry. 

b.  The  expulsion  system  shall  be  capable  of  becoming  a receiver 
system  In  case  of  an  emergency  requiring  shutdown  of  transfer 
and  offloading  of  the  Intended  receiver. 

c.  The  expulsion  system  selected  shall  be  capable  of  terminating 
transfer  operations  without  fluid  entrapment  In  any  component 
or  section.  Purge  and  relief  provisions  are  required. 

d.  Bladder  material  for  bladder  expulsion  concepts  shall  be  com- 
patible with  the  fluid  medltsn  and  be  capable  of  operation  with- 
out leakage  of  the  fluids  to  the  pressurization  side  of  the 
bladder . 

e.  The  material  for  use  In  bladder  walls  shall  consider  potential 
erosion  factor  under  conditions  where  slush  hydrogen  may  be 
created  In  tankage  from  Inadvertent  venting  In  space. 

f.  Any  expulsion  system  shall  Include  as  a requisite,  the  capability 
of  propellant  flow  measuring  devices  when  used  with  the  system. 

g.  Considerations  for  use  of  bellows  as  an  expulsion  device  shall 
Include  the  effects  of  ground  checkout  operations  and  maintenance 
Interface  when  the  tanks  are  empty  or  In  a saflng  operation. 

h.  The  capability  of  the  expulsion  system  under  pad  abort  conditions 
for  emergency  offload  of  the  fluids  shall  be  evaluated. 
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A.  Pressurization 

a.  The  concept  for  liquid/gas  conversion  using  a gas  generator  and 
pump  shall  consider  the  effects  on  the  system  due  to  potential 
instability.  Erratic  fuel  flow  to  the  pump  could  restrict  the 
output  head  below  the  point  where  the  heat  exchanger  could 
operate  in  a stable  condition.  The  oscillations  within  the 
heat  exchanger  could  create  the  instability. 

b.  The  pressurization  concept  shall  Include  provisions  for  automatic 
termination  and  safing  under  emergency  conditions. 

c.  Pressurization  concepts  shall  consider  the  range  and  rate  of 
pressurization  control  needed  for  regulating  pressures  for 
large,  small,  lightweight,  dewar-type  tanks  as  well  as  maximum 
pressures  for  receiver  and  user  vehicles.  Effective  use  must 

not  subject  any  of  the  tankage  or  vehicles  to  excessive  pressures. 

It  should  be  noted  that  at  the  time  of  this  criteria  development,  the 
use  of  a .large  storage  facility  was  envisioned  as  a CIS/RNS  and  tug  supportive 
depot.  Thus  Item  l.a(8)  prohibited  a vehicle  from  being  attached  during 
rotation  of  the  configuration  on  the  basis  that  disturbances  could  be  gener- 
ated which  could  subject  the  orbiter  and  crew  to  dynamic  instabilities, 
coupling  through  structure  with  RCS  reaction,  and  rotational  wobble  of  the 
configuration. 

When  studies  Indicated  no  large  depots  were  needed  for  the  logistic 
system,  this  criteria  was  modified  in  the  latter  part  of  the  study  to  require 
mated  elements  of  the  entire  configuration  to  be  man  rated  if  the  orbiter  is 
attached  during  propellant  transfer. 
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APPENDIX  F 

CONDITIONS  CONTRIBUTING  TO  HAZARDS 

A listing  of  conditions  contributing  to  hazards  of  the  Orbital  Propel- 
lant Logistic  Operations,  as  compared  to  those  of  other  operations,  is 
Included  for  reference  to  the  type  of  contributors  involved. 

1.  Tank  rupture  causes  fluids  to  mix,  4%  H2  - 2%  O2  minimum  at 
2 mm  Hg  or  more  pressure. 

2.  Line  rupture,  occurring  when  index  probes  did  not  release. 

3.  Uncontrolled  impact  ruptures  tanks  or  lines  and  causes  propellants 
to  mix,  4%  H2  - 2%  O2  minimum  and  local  pressures  of  2 mm  Hg  or 
more. 

4.  Erratic  fuel  flow  to  Gas  Generator  (GG)  liquid  sloshing  uncovers 
fuel  inlet. 

5.  Instability  of  Heat  Exchanger  (H/E). 

6.  Structural  failure  due  to  over-all  vehicle  dynamic  instability. 

7.  Improper  control  of  GG  regulators. 

8.  Fluids  in  cargo  bay;  hydrogen  accumulates  in  cargo  bay  to  4%  or 
more  in  air . 

9.  Loss  of  tank  pressure  causes  implosion  on  re-entry. 

10.  Index  probes  fall  to  release. 

11.  Quick  disconnect  (QD)  doesn't  seat  on  separation. 

12.  QD  damaged  and  leaks. 

13.  Electrical  connector  damaged. 

14.  Indexing  probe  falls  to  rigidlze  fixture. 

15.  Line  extension  bellows  ruptures  on  actuation. 

16.  Failure  to  seal  QD  on  mating. 

17.  Improper  stowing,  preventing  line  interconnect  fixture  mating. 

18.  Meteoroid  penetration. 


- 521  - 


SD72-SA-0054-3 


space  Division 

North  American  Rockwell 


19.  Penetration  by  space  debris. 

20.  Venting  In  cargo  bay  during  re-entry,  releasing  hydrogen. 

21.  Vent  valve  failure,  tank  overpressure  blows  rupture  disc. 

22.  GG  Instability. 

23.  Loss  of  remote  control  of  GG  and  H/E. 

24.  Thermal  shock  from  tank,  line  rupture  or  vented  gases. 

25.  lUipld  chllldown  of  system. 

26.  Blowing  leak  cracks  H/E  or  GG. 

27.  Impact  during  deployment  when  attached  to  manipulators. 

28.  Dynamic  coupling. 

29.  Erratic  operation  of  deployment  mechanism. 

30.  RCS  action  when  vehicles  are  captured  but  not  rlgldlzed. 

31.  Any  condition  leading  to  loss  of  vehicle  control  during  transfer. 

32.  Separation  attempts  before  complete  docking  release. 

33.  Failure  to  achieve  rlgldlzatlon  during  docking. 

34.  Intermittent  RCS  operation  while  docked  to  modular  element. 

35.  Loss  of  vapor  control. 

36.  Over  pressurization. 

37.  Instability  during  rotational  acceleration. 

38.  Instability  during  linear  acceleration. 

39.  Bolling  propellants  In  capillary  channels. 

40.  Premature  wetting  of  self-wlcklng  screens. 

41.  Structural  failure  of  capillary  screens  or  baffles. 

42.  Buckling  of  positive  displacement  diaphragms. 

43.  Inability  to  purge  positive  displacement  devices. 

44.  Leaking  diaphragms  or  bellows. 
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Dynamic  loading  of  Interfaces. 

Flex  line  rupture. 

Uncoordinated  manipulator  movement. 

Electrical  connector  failure. 

Erratic  operation  of  deployment  mechanism. 

Intermittent  RCS  with  module  on  manipulators. 

Impact  from  misalignment  causes  small  mass  to  rotate. 

Loss  of  docking  Interface  rlgldlzatlon. 

Depletion  of  RCS  propellants  (tug) . 

Wobble  during  rotational  transfer. 

Loss  of  data  on  propellant  quantity. 

Structural  failure  during  spln-up,  despin. 

Sloshing  of  propellants. 

Propulsive  Venting. 

Propulsive  leakage. 

Misalignment  of  docking  fixture. 

RCS  action  with  module  extended  on  manipulator  arms. 

Failure  of  structural  supports. 

All  the  other  hazards  are  contributors  to  degrading  man  rating 
when  manned  element  Is  attached. 

Failure  of  non-man  rated  systems  with  manned  element  attached. 
Obscured  vision. 

Plume  Impingement. 
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APPENDIX  G 

SAFETY  EVALUATION  OF  SLUSH  HYDROGEN 

INTRODUCTION 

One  of  the  considerations  during  the  study  was  the  possibility  of 
delivering  slush  hydrogen  Instead  of  liquid  hydrogen  to  the  space-based 
vehicles.  Since  the  hydrogen  bolloff  loss  constitutes  one  of  the  major  pro- 
pellant losses  during  space  storage,  the  use  of  slush  hydrogen  can  reduce 
this  loss  by  Increasing  the  amount  of  heat  absorbed  by  the  bulk  propellant 
before  It  reaches  the  saturation  temperature.  Slush  hydrogen  (SH2)  Is  a 
mixture  of  small  solid  hydrogen  particles  and  liquid  hydrogen  which  can  be 
transferred  much  like  a liquid.  The  mixture  offers  the  advantage  of  sub- 
stantially Increasing  the  bulk  propellant  heat  capacity  which  results  In  a 
potential  reduction  In  bolloff  losses.  Additional  advantages  of  slush  hydro- 
gen are  an  Increase  In  bulk  density,  which  suggests  a smaller  storage  tank, 
and  lower  tank  storage  pressures  resulting  In  reduced  pressurization  gas 
requirements.  Consequently,  the  literature  on  slush  hydrogen  was  reviewed 
and  evaluated  for  potential  hazards  associated  with  application  to  propellant 
logistic  programs. 

HANDLING  CHARACTERISTICS 

Slush  hydrogen  must  be  aged  for  at  least  five  hours  so  that  handling 
characteristics  will  be  consistent  and  accurately  predictable.  Small  scale 
manufacturing  and  testing  shows  that  50  percent  slush  hydrogen  can  be  handled 
much  like  liquid  hydrogen  except  that  continuous  stirring  may  be  required  to 
prevent  settling  and  an  agglomeration  of  solid  particles.  Propellant  loading 
Into  the  propellant  tank  located  In  the  cargo  bay  Is  discussed  In  Section  4, 
paragraph  4 . 2 . 1 . 2 . 

In  both  ground  and  orbital  operations,  an  agglomeration  of  solid  particles 
could  be  expected  If  continuous  stirring  or  movement  Is  not  provided.  Under 
any  off  specification  condition  for  maintaining  the  desired  mass  fraction, 
hazards  could  be  created.  Hazards  could  be  created  In  propellant  lines  and 
tanks,  namely  due  to  loss  of  ground  thermal  environment  establishing  two- 
phase  flow,  causing  slugging  and  excess  venting  respectively.  Clogging  of 
the  vent  system  In  orbit  could  be  expected  due  to  formation  of  Ice  masses 
over  the  vent  ports  when  the  stirring  Is  low  and  sloshing  has  occurred,  or 
due  to  a zero  "G"  environment  where  the  stirring  device  does  not  have  the 
capability  to  stir  properly  due  to  the  orientation  of  the  slush  hydrogen  In 
the  tank. 

It  can  be  postulated  that  In  the  event  of  an  abort  of  the  shuttle  orblter 
after  liftoff  and  before  attainment  of  orbit,  the  off  loading  of  the  slush 
hydrogen  In  the  propellant  tank  module  could  present  hazards.  In  systems 
where  screens  and/or  baffles  are  used,  the  Ice  crystals  of  hydrogen  may  be 
collected  on  these  surfaces  and  the  liquid  only  off  loaded  by  use  of  the 
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tank  pressure.  This  could  load  the  screens,  bridge  openings  or  cause  failures 
of  the  mechanical  systems  which  could  preclude  a safe  abort.  This  condition 
will  be  similar  in  the  case  where  the  loss  of  Insulation  on  the  tank  module 
provides  a gross  heat  leak  which  requires  emergency  venting  beyond  the  capa- 
bility of  the  normal  tank  vent  valve  to  relieve  the  expansion  of  the  slush 
hydrogen. 

The  state-of-the-art  for  storage  and  handling  of  slush  has  not  been 
extended  beyond  small-scale  laboratory  testing  such  that  identification  of 
hazards  without  a definitive  system  design  has  been  based  on  the  available 
aspects  postulated  from  laboratory  conditions. 

Some  of  the  postulated  aspects  where  hazards  could  be  generated  in  a 
slush  hydrogen  system  for  space  vehicles  could  involve: 

a.  Compatibility  with  "In-Tank"  Mechanical  Devices 

Little  is  known  of  the  effects  of  the  interaction  of  zero  "G" 
environmental  sloshing  and  the  bridging  of  solid  hydrogen  particles 
over  such  areas  as  vent  valve  tank  outlets,  gas  generator  line  tank 
outlet,  and  fill  and  drain  outlets.  In  the  earth  environment,  the 
baffles  and  stirring  system  could  present  similar  considerations. 

This  effect  (bridging)  was  noted  by  Charles  U.  Elrod  in  his  large 
scale  slush  hydrogen  production  experiments.  Tech  Report 
AFAPL-TR-65-33  of  July  1965. 

Additionally,  in  the  case  where  the  transfer  system  flow  is 
terminated  for  a period  of  time  such  as  a hold,  loss  of  required 
thermal  environment  in  localized  areas  of  lines,  could  produce 
high  localized  pressures  which  could  cause  tank  baffle  damage 
when  the  flow  is  started  again,  due  to  slug  flow. 

b.  Instrumentation  and  Measurement 

The  requirements  for  instrumentation  and  measuring  devices  for  a 
full-scale  flight  weight  propellant  tank  module  will  present  a 
design  driver  to  propellant  logistic  transfer  systems.  The  quantities 
of  propellants  transferred  is  a function  of  the  solid  mass  fraction. 
While  this  can  be  determined  during  ground  loading  operations  within 
prescribed  limits,  the  capability  to  gage  the  quantities  of  propel- 
lants transferred  in  orbital  operations  is  unknown  and  should  be 
subjected  to  detailed  analysis.  While  this  aspect  should  not  present 
any  safety  problems,  the  inability  of  the  system  to  measure  residual 
slush  hydrogen  accurately  will  present  a major  hazard.  This  hazard 
is  associated  with  retrieval  of  the  tank  module  for  earth  return  in 
the  shuttle  orbiter  cargo  bay.  If  the  quantity  of  residual  propel- 
lants in  the  tank  module  cannot  be  measured  accurately,  loss  of 
thermal  protection  insulation  during  re-entry  could  create  an  ex- 
plosion due  to  excessive  venting  or  tank  over-pressurization,  from 
flashing  of  residual  propellants  into  a vapor. 
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c.  Critical  Flow  Velocity  as  a Function  of  Pipe  Dlaaeter 

Since  this  aspect  is  well  documented  (Reference  52)  and  design  aspects 
known  for  preventing  agglomeration  of  the  ice  particles  it  is  not 
considered  a safety  problem.  Operational  problems  could  develop, 
however,  which  could  be  hazardous.  This  could  be  in  the  case  where 
the  facility  loading  lines  failed  to  flow  the  slush  hydrogen  at  the 
design  velocity.  It  could  be  postulated  that  a line  rupture  could 
occur  at  a "hot"  thermal  leak  point  in  the  line. 

d.  Llquld/Ice  Stratification  in  Deep  Tanks 

In  a zero  "G"  environment  with  random  movement  of  propellants,  con- 
ditions could  be  created  which  were  hazardous  to  Internal  tank  systems. 
Ice  chunks  breaking  off  from  baffles,  wall,  etc.,  could  Impact  in- 
ternal mechanical  devices  damaging  the  mechanism.  This  could  be 
postulated  to  occur  at  docking  impact. 

e.  Chllldown  Aspects  of  Orbital  Tanks 

As  a firm  design  of  orbital  tank  systems  is  made  for  use  with  slush 
hydrogen,  the  operational  aspects  of  chllldown  procedures  for  initial 
orbital  use  should  be  evaluated  for,  among  other  things,  conditions 
which  could  cause  stressing  of  its  components  end  lines. 


f.  Electrostatic  Buildup 

The  quantity  and  effects  of  electrostatic  charge  generation  during 
slush  hydrogen  transfer  through  long  lines  should  be  investigated. 
These  effects  should  be  considered  for  the  docked  configurations  of 
space  vehicles  during  transfer  operations  in  orbit. 

SAFETY  EVALUATION 

There  does  not  appear  to  be  any  aspects  of  design  of  slush  hydrogen 
systems  which  would  preclude  its  safe  use  except  in  the  area  of  thermal 
protection  systems  during  ground  operations  for  flight  weight  propellant 
tank  modules . 

In  the  literature  there  appears  to  have  been  much  effort  on  storage  of 
SH2  in  small  quantities  using  Dewars.  The  flight  weight  thermal  protection 
for  flight  weight  tanks  providing  equal  protection  Is  non-sziatsnt.  This 
is  the  area  which  will  control  the  production  of  hazards  in  ground  operations. 

There  also  is  no  system  which  can  provide  accurate  data  on  residual  SH2 
quantities  in  orbital  propellant  tank  modules.  The  quantity  of  these  residuals 
must  be  known  as  they  could  Impact  the  safe  return  of  the  tank  in  the  shuttle 
arbiter  cargo  bay.  Each  tank  will  have  to  be  designed  for  specification 
residuals.  The  residual  propellants  from  a safety  vlewpoing  Involve  tank 
pressure,  vent  size,  vent  actuation  time,  pressure  relief  system  and  emergency 
system.  Loss  of  the  thermal  protection  for  the  tank  could  cause  over-pressuri- 
zation of  the  tank  during  re-entry  if  residual  propellants  are  more  than 
design  allowable. 
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The  hazardous  aspects  associated  with  sloshing  of  propellants  In  zero 
"G"  would  be  expected  to  diminish  In  orbital  operations,  except  In  those 
cases  of  docking  Impact. 

CONCLUSIONS 

a.  In  systems  which  are  to  be  returned  to  earth  such  as  propellant 
tank  modules  In  the  orblter  cargo  bay,  some  extensive  work  Is 
required  to  provide  a technique  for  accurately  determining  residual 
propellants  (slush  hydrogen)  after  propellant  transfer  and  prior 

to  return  to  earth  In  the  orblter  cargo  bay. 

b.  The  abort  requirement  for  offloading  slush  hydrogen  Is  a driver  In 
the  design  for  emergency  dump  systems  for  orblter  abort. 

c.  Continued  study  of  hazards  of  using  slush  hydrogen  should  be 
ibade  when  the  requirement  for  Its  use  is  firmed. 
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Document  No.:  TMX-64538  Date:  7-1-70  Pages:  19 
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modes  of  operation  for  orbital  propellant  storage  for  the  near-term  space 
program. 
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Author : AFSC 

Agency/Publlsher:  AFSC 

Document  No.:  DH  1-X  Date:  7-15-70  Pages:  - 

System  Safety  guidelines  and  requirements  by  systems  and  subsystems  In 
checklist  form. 

4.  Title:  AFSC  Design  Handbook,  System  Safety 

Author : AFSC 

Agency/Publlsher:  AFSC 

Document  No.:  DH  1-6  Date:  7-20-71  Pages:  300+ 

System  Safety  guidelines  and  requirements  In  by  systems  and  subsystems. 
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5.  Title:  Docking  and  Transfer  Problem  Survey 

Author:  Perry  L.  Gardner 

Agency/Publisher:  AIAA 

Document  No.:  69-1118  Date:  Oct.  1969  Pages:  5 

A generalized  survey  of  the  problems  associated  with  the  subject,  many 
of  which  have  been  solved  since  the  article  was  written. 

6.  Title:  Cryogenic  Solid  Oxygen  Storage 

Author:  John  E.  Ahern,  Truman  W.  Lawson,  Jr.,  AGC 

Agency/Publisher:  AMRL 

Document  No.:  AMRL-TR-68-105  Date:  Dec.  1968  Pages:  158 
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7.  Title:  An  Early  Earth-Orbital  Propellant  Transfer  Mission 

Author:  M.  C.  Ziemke,  L.  E.  Toole,  and  T.  F.  Stomps  (Chrysler) 

Agency/Publisher:  AIAA  (Symposium  on  Missiles  & Aerospace  Vehicles) 
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8.  Title:  Electrostatic  Hazards  Associated  with  the  Transfer  & Storage  of  LH2 
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Agency/Publisher : Advances  In  Cryo  Engineering 
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9.  Title:  Evaluation  of  Experimental  and  Analytical  Data  for  Orbital 

Re-fuellng  Systems 
Author:  C.  C.  Wood,  H.  F.  Trucks 

Agency/Publisher : AIAA 

Document  No.:  69-566  Date:  6/9-13/69  Pages:  11,  28  Ref 

Outlines  proposed  project  "Therms"  to  conduct  orbital  fluid  transfer 
experiment  to  accumulate  fundamental  data  on  fluid  behavior. 

10.  Title:  An  Experimental  Study  of  Hydrogen  Slush  Pumping  Characteristics 

Author:  L.  A.  Gross  and  C.  D.  Miller 

Agency/Publisher : NASA/MSFC 

Document  No.:  IN  P&VE-P-68-3  Date:  12  Aug  1968  Pages:  21,  4 Ref 

A report  of  the  results  of  pumping  tests  at  NBS,  Boulder,  Colorado 
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11.  Title:  Flow  Research  System  for  LH2  and  SH2 

Author:  T.  N.  Marshall,  Jr. 

Agency/Publisher : Instr^  Society  of  America 

Document  No.:  24th  Conference  Proceedings  Date:  1969  Pages:  5 

A large  scale  liquid  and  slush  hydrogen  production  and  flow  facility 
system  being  built  at  MSFC  to  study  production  and  transfer  of  slush. 

12.  Title:  Fluid  Hydrogen  Slush  - A Review 

Author:  G.  A.  Cook  and  R.  F.  Dwyer 

Agency /Publisher : Advances  in  Cryo  Engineering 

Document  No.:  Vol.  II  Date:  1966  Pages:  202-206 

A review  of  the  properties  and  advantages  of  slush  over  liquid  hydrogen. 

13.  Title:  Generation  and  Loading  of  Triple  Point  Hydrogen  for  High 

Performance  Aircraft,  Boosters  and  Spacecraft 
Author:  N.  E.  Stanley  (MDAC) , C.  U.  Elrod  (WPAFB) 

Agency /Publisher : AIAA 
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A report  of  the  progress  and  data  from  two  years  of  slush  cryogen  studies 
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14.  Title:  Handling  Liquid  Propellants 

Author:  Louis  L.  Dachs 

Agency /Publisher:  Space/Aeronautics 

Document  No.:  Date:  Oct.  1966  Pages:  7 

A discussion  of  theoretical  and  practical  fluid  phenomena,  including 
Zero  G. 

15.  Title:  Hazard  Studies  with  H2  and  O2  in  the  Liquid  and  Solid  Phases 

Author:  S.  Kay,  GDC 

Agency/Publisher:  Advances  in  Cryo  Engineering 

Document  No.:  Vol.  11  Date:  1966  Pages:  277-86 

A report  of  the  ignition  properties  of  hydrogen-oxygen  mixtures  at 
reduced  pressures. 

16.  Title:  High  Altitude  Explosion  Properties  of  the  H2-O2  System  in  Vented 

Tanks 

Author:  S.  Kay,  R.  J.  Murray 

Agency/Publisher:  Advances  in  Cryo  Engineering 

Document  No.:  Vol.  13  Date:  1968  Pages i 545-554 

A report  of  the  ignition  properties  of  hydrogen-oxygen  mixtures  at 
reduced  pressures . 
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17.  Title:  Hydrogen->Oxygen  Reaction  Studies,  Final  Report 

Author:  S.  Kaye,  J.  Rosclszewskl,  R.  J.  Murray,  J.  G.  Koency, 

G.  T.  Bayfield 
Agency/Publisher : GDA 

Document  No.:  GDC-DBE-67-016  Date:  9-67  Pages:  197 

The  results  of  study  and  experiments  conducted  by  GDC  on  the  reaction 
potential  of  hydrogen-oxygen  under  reduced  pressure  and  various  mixture 
ratios . 

18.  Title:  Hydrogen-Oxygen  Reaction  Studies,  Final  Report 

Author:  S.  Kaye,  G.  T.  Bayfield 

Agency/Publisher:  GDA  (MSFC  Contr.  NAS8-11405) 

Document  No.:  DCN  1-4-96-01009-01  Date:  12/65  Pages:  407 

The  results  of  study  and  experiments  conducted  by  GDC  to  assess  the 
nature  and  extent  of  the  detonation  or  explosive  hazards  of  the 
hydrogen-oxygen  system  at  reduced  pressures. 

19.  Title:  Integrated  Space  Program  and  Vehicle  Systems  Analysis  - Study  "B" 

Author:  Aerospace  Corp. 

Agency/Publisher : Final  Report  to  be  ATR-71(7232)-5 

Document  No.:  Final  Monthly  Report  Date:  6-30-71  Pages:  96 

Includes  a discussion  of  "On-Orbit  Testing”  and  potential  problems 
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20.  Title:  Investigation  of  the  Effects  of  Vacuum  on  LH2  and  Other  Cryogens 
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Author:  J.  A.  Simmons,  R.  D.  Gift,  M.  Markels,  Jr.  (Atl.  Res.) 

Agency/Publisher : Atlantic  Research  Corp.  (Contr.  NAS8-11044 

The  reaction  of  liquid  propellants  on  exposure  to  simulated  space 
conditions. 

21.  Title:  Liquid  Hydrogen  Technology 

Author:  R.  T.  Parmley 

Agency/Publisher:  GDA 

Document  No.:  Report  ISIAE62-0774  Date:  Sept.  1962  Pages:  294 

The  properties  of  liquid  hydrogen.  Including  a section  on  Zero  G 
behavior  and  space  storage. 

22.  Title:  Liquid  Propellant  Handling,  Storage  and  Transportation 

Author:  JANNAF  Hazards  Working  Group 

Agency/Publisher : CPIA 

Document  No.:  194  Vol.  3 Date:  April  1970  Pages:  412 

General  ground  handling  of  liquid  propellants. 
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Author:  P.  B.  Mann,  P.  R.  Ludtke,  C.  F.  Sindt,  D.  B.  Chelton 

Agency/Publisher : Advances  in  Cryo  Engineering 

Document  No.:  Vol.  11  Date:  1966  Pages:  207-217 

A report  on  the  work  on  slush  hydrogen  that  occurred  at  NBS  Boulder, 
Colorado . 

24.  Title:  Maintainability  of  Manned  Spacecraft  for  Long  Duration  Flights 

Author : Boeing 

Agency /Publisher : Boeing 
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Author : MSC 
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Document  No.:  MSCM  8080  Date:  11-2-71  Pages:  137 
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27.  Title:  On-Orbit  Maintenance  of  the  Orbit-to-Orbit  Shuttle 

Author:  J.  H.  Todd 

Agency /Publisher : Aerospace 

Document  No.:  TOR-0059(6531-03)-1  Date:  3-15-71  Pages:  57 
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Author:  Ray  Goodall 

Agency/Publisher : LMSC 

Document  No.:  RTD-TDR-63-4057  Date:  3-64  Pages:  356 
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and  Analysis 
Author:  L.  R.  Hogan 

Agency/Publlsher : NR/SD 

Document  No.;  SD72-SS-0001  Date:  1-72  Pages:  300f 

A study  of  the  lA  Interfacing  activities  of  orbital  operations. 

30.  Title:  Orbiting  Propellant  Depot  for  Chemical  Orbit-to-Orblt  Shuttle 

Author:  L.  L.  Schllb 

Agency/Publisher : Aerospace 
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Agency/Publisher:  Advances  in  Cryo  Engineering 

Document  No.:  Vol.  15  Date:  1970  Pages:  467-475 
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Author : 
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Slush  Hydrogen  pumping  study  conducted  at  NBS,  Boulder,  Colorado 

55.  Title:  Slush  and  Subcooled  Propellants  for  Lunar  and  Interplanetary 

Missions 

Author:  J.  L.  Vaniman,  A.  L.  Worlund,  T.  W.  Winstead,  NASA/MSFC 

Agency/Publisher : Advances  in  Cryo  Engineering 

Document  No.:  Vol.  14  Date:  1969  Pages:  20-29 

Slush  and  subcooled  cryogens  can  extend  capabilities  of  current  launch 
vehicles. 

56.  Title:  Solidified  O2  for  Breathing  in  Space 

Author:  N.  Plaks  (AGC) , K.  Welswurm  (WPAFB) 

Agency/Publisher:  Advances  in  Cryo  Engineering 

Document  No.:  Vol.  13  Date:  1968  Pages:  430-437 

Experimental  and  analytical  study  of  SOX. 

57.  Title:  Space  Mission  Duration  Extension  Problems,  A Study  of 

Author:  R.  B.  Carpenter,  Jr. 

Agency/Publisher : NR/SD 

Document  No.:  SD67-478-3  Date:  Oct.  1967  Pages: 

An  analytical  study. 

58.  Title:  Space  Shuttle  Phase  B Final  Report  Volume  II,  Technical 

Summary,  Book  3,  Booster  Vehicle  Definition 
Author:  NR/SD 

Agency/Publisher : NR/SD 

Document  No.:  SD71-114-2(3) (MSC-03307)  Date:  3-26-71  Pages:  300+ 

This  book  defines  the  configuration  and  operation  of  the  B-9  Booster. 

59.  Title:  Space  Shuttle  Phase  B Final  teport  Volume  II,  Technical 

Summary,  Book  II,  Orblter  Vehicle  Definition 
Author:  NR/SD 

Agency/Publisher:  NR/SD 

Document  No.:  SD71-114-2 (2) (MSC-03307)  Date:  3-26-71  Pages:  300+ 

This  book  presents  the  161C  orbiter  and  requirements,  general  arrange- 
ment, mass  properties  flight  operational  and  performance  characteristics, 
subsystems  definition  and  functional  Interfaces  and  manufacturing 
approach. 
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60.  Title:  The  Space  Simulators  of  O.N.E.R.A. 

Author:  Jean  Suruget,  Marcel  LeMlgnon 

Agency/Publlsher : Spaceflight 

Document  No.:  — Date:  — Pages:  250-255 

French  space  environment  simulators. 

61.  Title:  Space  Station  Safety  Study  (MSC-00189)  Crew  Safety  Guidelines, 

Vol.  I and  II 

Author:  E.  L.  McCabe,  E.  P.  Goodrich,  W.  N.  Gilbert 

Agency/Publlsher:  Boeing 

Document  No.:  D2-113070-5  Date:  1-70  Pages:  395 

A thorough  system  safety  analysis  of  the  Space  Station. 

62.  Title:  STS  Propellant  Loading  System 

Author : — 

Agency/Publlsher:  Aerospace  Corp. 

Document  No.:  69-5111.17-18,  70(5758-03)-8  Date:  1970  Pages:  27 

A study  to  determine  If  the  specified  two-hour  reaction  time  Is  adequate 
to  load  propellants  on  the  STS. 

63.  Title:  A Study  of  Human  Performance  In  a Rotating  Environment 

Author:  J.  A.  Green,  J.  L.  Peacock,  A.  P.  Holm 

Agency/Publlsher:  NR/SD 

Document  No.:  SD70-456,  NASA  CR  111866  Date:  1971  Pages:  233 

The  results  of  a series  of  tests  on  human  subjects  In  a rotating 

facility. 

64.  Title:  A Study  of  Hydrogen  Slush  and/or  Hydrogen  Gel  Utilization 

Author;  C.  W.  Keller  (LMSC) 

Agency/Publlsher:  LMSC 

Document  No.:  K-11-68-1K  Date:  31  Oct.  1968  Pages:  Vol.  1-76 

Vol.  11-136 

A discussion  of  the  benefits  to  be  derived  by  the  use  of  slush. 

65.  Title:  A Study  of  Space  Mission  Duration  Extension  Problems 

Author:  R.  B.  Carpenter,  Jr. 

Agency/Publlsher:  NR/SD 

Document  No.:  SD67-478-3  Date:  10-30-67  Pages:  350 

An  analytical  study. 
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66.  Title:  A Study  of  Teleoperator  Technology  Development  and  Experiment 

Programs  for  Manned  Space  Flight  Applications 
Author:  A.  Interlan  (GE) 

Agency/Publlsher : GE,  SSO  Date:  1-15-71  Pages:  300+ 

. This  study  continues  previous  Industrial  work  In  applying  teleoperator 
systems  and  Identifies  the  technology  required  to  develop  teleoperator 
applications  for  manned  space  flight. 

67.  Title:  A Summary  of  the  Characterization  Study  of  Slush  H2 

Author:  C.  Slndt 

Agency/Publlsher:  Cryogenics 

Document  No.:  — Date:  Oct.  1970  Pages:  372-380 

A review  article  of  the  benefits  of  using  slush. 

68.  Title:  System  Requirements,  Mission  Capability  and  Operations  Analysis  - 

S-II  Stage  Interorbital  Shuttle  Capability  Analysis 
Author:  NR/SD 

Agency/Publlsher:  NR/SD 

Document  No.:  SD71-245-2  Date:  2-71  Pages:  300+ 

A CIS  can  meet  program  and  operations  requirements. 

69.  Title:  Systems  Safety  Guidelines  of  New  Space  Operations  Concepts  - 

Space  Shuttle  Program 
Author:  W.  L.  Finch,  D.  A.  Smith 

Agency/Publlsher:  LMSC 

Document  No.:  LMSC-A968322  Date:  7-70  Pages  31,  136 

A system  safety  analysis  of  the  space  shuttle. 

70.  Title:  System  Safety  Requirements  for  Manned  Space  Flight 

Author:  MSC 

Agency/Publlsher:  MSC 

Document  No.:  SPD-IA  Date:  12-12-69  Pages:  8 

Establishes  System  Safety  methodology  for  space  programs. 

71.  Title:  Systems  Safety  for  ^nned  Operations  In  Earth-Orbital  Missions 

Author:  G.  S.  Canettl 

Agency/Publlsher:  NR/SD 

Document  No.:  SD71-230  Date:  7-15-71  Pages:  10 

This  paper  describes  how  System  Safety  considerations  have  Influenced 
the  operations,  configuration  and  design  of  manned  earth  orbital 
elements . 
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72.  Title;  Technical  Proposal  for  Low  Gravity  Propellant  Transfer 

Author:  R.  A.  Beaudreau,  D.  F.  Gluck,  et  al 

Agency/Publisher ; NR/SD 

Document  No.;  DNO  70-190,  SD70-72  Date:  3-19-70  Pages:  74 

A proposal  to  perform  an  analytical  study  of  potential  methods  of 
replenishing  the  APS,  ECLSS,  and  fuel  cell  storage  tanks. 

73.  Title:  Testing  of  a Cryogenic  Propellant  Subsystem  in  a Simulated  Space 

Environment 

Author:  T.  J.  Kelley,  USAF 

Agency /Pub Usher:  AFRPL  Date:  3-70  Pages:  88 

Description  of  techniques  of  use  and  design  of  space  simulators. 

74.  Title:  TNT  Equivalency  Study  for  Space  Shuttle 

Author:  R.  R.  Wolfe 

Agency /Publisher : 

Document  No.:  ATR-71(7233)-4 , Vol.  I,  II,  III 

Date:  Pages: 

This  study  re-evaluates  the  existing  TNT  equivalency  criterion  for 
LO2/LH2  propellant. 

75.  Title:  Use  of  Man  in  Space 

Author:  B.  Howard  and  G.  T.  Orrok  (Bellcomm) 

Agency/Publisher : AIAA 

Document  No.;  69-1045  Date:  Oct.  1969  Pages:  8 

Explores  the  questions  of  when  and  where  to  use  man  Instead  of  machines 
in  space. 

76.  Title:  Use  of  Slush  H2  for  the  Propulsion  of  Spacecraft 

Author:  D.  Chain 

Agency/Publisher:  Assn.  Francaise  des  Ingenleurs  et  Technicians 

Document  No.:  NASA  TTF-12,827  Date:  6/2,4/69  Pages:  14 

A French  study  was  conducted  to  explore  the  advantages  and  disadvantages 
of  hydrogen  slush. 
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ADDENDA 

The  below  listed  documents  which  provided  Information  that  was  relative 
to  the  In-Space  Propellant  Logistics  & Safety  Study  were  received  Incrementally 
throughout  the  study,  after  compiling  the  results  of  the  original  Literature 
Survey . 

lA.  Title:  Acoustic  Pumping  for  Propellant  Management  In  Space 

Author:  P.  S.  Wessels 

Agency : GDC , Pomona 

Publisher:  Space/Aeronatlca 

Document  No.:  Date:  6/69  Pages:  75-77 

A light-weight  propellant  settling  technique  using  acoustic  energy  to 
drive  propellants  away  from  the  sound  source  Is  under  development  at  GDC. 

2A.  Title:  An  Analysis  of  the  Dynamics  and  Thermodynamics  of  Water  and 

Oxygen  Particles  In  Space  Based  on  Photographs  Taken  from  the 
Ground  During  Apollo  Missions 
Author:  R.  D.  Sharma,  M.  L.  Kratage  (Bellcomm) 

Agency/Publlsher:  AIAA 

Document  No.:  71-474  Date:  4/26-28/71  Page:  6 

Observations  of  the  venting  of  fluids  from  S-IVB  during  various  Apollo 
missions. 

3A.  Title:  Application  of  Heat  Pipes  to  Reduce  Cryogenic  Bolloff  In  Space 

Author:  J.  L.  Thurman  and  E.  H.  Ingram 

Agency:  Brown  Engineering,  Huntsville 

Publisher:  Journal  of  Spacecraft  and  Rockets 

Document  No.:  Date:  3/69  Pages:  319-321 

A proposal  to  use  structures  of  very  high  heat  conductance  to  transfer 
heat  between  source  and  sink  to  reduce  bolloff  In  space. 

4A.  Title:  Contamination  Sensitivity  Analysis 

Author:  G.  L.  Wengrow 

Agency/Publlsher : NR/SD 

Document  No.:  192-500-CWR-72-019  Date;  1/24/72  Page;  22 

A discussion  of  potential  contamination  of  shuttle  carried  experiments 
with  the  conclusion  that  problems  from  deposition  of  materials  onto 
sensitive  surfaces  are  potentially  serious. 
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5A.  Title:  Dlelectrophoretlc  Liquid  Expulsion 

Author:  Melcher  et  al 

Agency:  M.I.T.  and  Dynatech 

Publisher:  J.  Spacecraft  and  Rockets 

Document  No.:  Date:  9/69  Pages:  961-967 

Experimental  data  presented  to  settle  propellants  by  means  of  an  electric 
field. 

6A.  Title:  Lightweight  Multilayer  Insulation  System.  Final  Report 

(NASA-CR-72363) 

Author:  C.  R.  Lindquist  and  G.  E.  Nles 

Agency:  Linde  Company 

Document  No.:  Date:  2/23/68  Page:  194 

The  development  and  testing  of  a shingled  multi-layer  system  on  a 
30- Inch  diameter  liquid  hydrogen  tank  that  resulted  In  a heat  flux  of 
0.63  Btu/hr.  ft^  for  In-space  conditions  and  10  Btu/hr.  ft^  for  ground 
hold. 

7A.  Title:  Nuclear  System  Safety 

Author:  E.  Gerrels,  et  al 

Agency/Publlsher : G.E.  NSP 

Document  No . : GESP-7068 

Final  performance  review  of  Contract  NAS8-26283  ^ 

8A.  Title:  Orbital  Storage  of  Liquid  Propellants 

Author:  P.  0berdlng»  S.  J.  Tick 

Agency/Publlsher:  Reaction  ^b)tors,  Thlokol 

Document  No.:  RMD  23005-126  Date:  4/17/64  Page:  39 

A fundamental  study  of  the  calculation  of  the  heat  flux  Incident  on  a 
propellant  Storage  tank  In  the  space  environment  In  the  vicinity  of  a 
planet . 

9A.  Title:  Orblt-to-Orblt  Shuttle  Propellant  Integration  and  Handling  Study 

Author:  D.  A.  Heald,  G.  R.  Stone,  S.  Kaye  (GDC) 

Agency/Publlsher:  AFSPL  (Contract  F04611-70-C-0087) 

Dociiment  No.:  GDC-BMZ70-013-18  Date:  12/71  Page:  253 

This  study  examines  the  hazards  Inherent  In  the  design  and  operation  of 
ground  and  vehicle  systems  for  a liquid  fluorine  space  vehicle. 

lOA.  Title:  Setting  the  Structural  Design  Criteria  for  Space  Debris  Effects 

In  Clslunar  and  Outer  Space  Travel 
Author:  Sydney  D.  Black  (Republic) 

Agency/Publlsher:  Society  of  Automotive  Engineers 

Document  No.:  520E  Date:  4/3/62  Page:  14 

Evaluating  the  limits  to  be  set  In  material  selection  and  structural 
design  so  that  the  existing  space  debris  environment  can  be  tolerated 
by  a space  vehicle. 


- Transportation  by  Earth  Space  Shuttle 
Date:  10-21-71  Page:  156 
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llA.  Title:  Space  Base  Nuclear  System  Safety  Study 

Author:  E.  Gerrels,  et  al 

Agency/Publisher : G.E.  NSP 

Document  No.:  GE-SP7059  Date:  11/24/70  Pages:  300 

First  performance  review  that  outlines  the  course  of  the  study. 

12A.  Title:  Space  Rescue  Considerations 

Author;  Rodney  G.  Rose  (NASA,  Houston) 

Agency/Publisher : NASA 

Document  No.:  MSC-04901  Date:  9/20/71  Pages:  41 

The  rescue  requirements  for  ear th*-orbl ting  vehicles  In  the  post- 
skylab  era  are  examined,  with  causes  of  occurrence  and  rescue  time 
considered. 

13A.  Title:  Space  Tug,  Point  Design  Study,  Final  Report,  Vol.  Ill 

Design  Definition 
Author:  NR/SD 

Agency/Publisher : NR/SD 

Document  No.:  SD72-SA-0032  Date:  2/11/72  Pages:  300f 

Verified  through  detail  design  and  analysis  the  capability  to  deliver 
and  retrieve  a 3720-pound  payload  to  a geosynchronous  orbit  from  a 
low  earth  orbit  and  a mass  fraction  of  better  than  0.90. 

14A.  Title:  Testing  of  Polymeric  Materials  for  Use  In  Multiple-Ply 

Expulsion  Bladders  for  Cryogenic  Liquids 
Author:  F.  H.  Pope  and  J.  E.  Penner 

Agency:  Beech  Aircraft,  Boulder 

Publisher:  Journal  of  Spacecraft 

Document  No.:  Date:  3/68  Pages:  259-264 

As  a result  of  testing  it  Is  concluded  that  polymeric  expulsion 
bladders  are  feasible  for  the  isolation  of  pressure  source  and 
cryogenic  fluids. 

15A.  Title:  Zero-g  Hydrogen  Tank  Venting  System 

Author:  R.  C.  Mitchell,  et  al 

Agency : GDC 

Publisher:  Advances  In  Cryo  Engineering,  Vol.  12 

Document  No.:  Date:  6/66  Pages:  72-81 

A paper  describing  the  results  of  a study  conducted  for  NASA  to 
determine  the  relative  merit  of  several  methods  to  separate  liquid 
and  gas  for  venting  liquid  hydrogen  tanks. 


349 


SD72-SA-0054-3 


Space  Division 

North  American  Rockwell 


16A.  Title:  Zero-g  Propellant  Gauging  of  Cryogenic 

Author:  R.  G.  Morrison 

Agency:  TRW  Systems  Group 

Publisher:  NASA,  N71-35036 

Document  No.:  Date:  5/11-13/71  Pages:  37-52 

Investigation  of  techniques  (other  than  RF)  of  measuring  the  quantity 
of  cryogenics  in  a tank  at  zero-g  indicates  that  nucleonic  systems 
offer  the  most  promise. 

17A.  Title:  Zero-g  RF  Gaging  System 

Author:  H.  E.  Thompson,  NASA,  N.  E.  Stanley,  et  al,  Bendix 

Agency/ Publisher:  NASA 

Document  No.:  N71-35037  Date:  Pages:  53-72 

Experimental  evidence  indicates  that  RF  gauging  systems  are  feasible 
for  measuring  the  quantity  of  cryogenic  fluids  in  a tank  at  accuracies 
in  the  range  of  1 to  2.72. 
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APPENDIX  I 

LIST  OF  ABBREVIATIONS  AND  DEFINITIONS 


ACPS 

ACS 

APU 

BSP 

CIS 

DMS 

DRS 

ECS 

ECLSS 

ESS 

G&C 

GG 

GLR 

GN&C 

IMU 

lU 

LOW 

LSF 

LSS 

NPSP 

mm 

n ml 

NR 

OBCO 

OMS 

OPD 

OPSS 

PLSS 

RCS 

RNS 

SLR 

SH2 

SS 

TUG 


Attitude  Control  Propulsion  System 

Attitude  Control  System 

Auxiliary  Power  Unit 

Study  Baseline  Space  Program 

Chemical  Interorbital  Shuttle 

Data  Management  System 

Data  Relay  Satellite 

Environmental  Control  System 

Environmental  Control  and  Life  Support  System 

Expandable  Second  Stage 

Guidance  & Control 

Gas  Generator 

Guldellne/Requlrement 

Guidance,  Navigation  and  Control 

Inertial  Measuring  Unit 

Instrument  Unit 

Liftoff  Weight 

Large  Storage  Facility 

Life  Support  System 

Net  Positive  Suction  Pressure 

Millimeter 

Nautical  Miles 

North  American  Rockwell  Corporation 

Onboard  Checkout 

Orbital  Maneuvering  System 

Orbital  Propellant  Depot  (also  called  Depot) 

Orbital  Propellant  Storage  System 

Portable  Life  Support  System 

Reaction  Control  System 

Reusable  Nuclear  Shuttle 

Scanning  Laser  Radar 

Slush  Hydrogen 

Space  Shuttle 

Space  Tug 
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Docking  Section 
Assembly  Ports 
Docking  Ports 

Soft  Docking 
Hard  Docking 

Series  Loading 

Parallel  Loading 
Free  Volume 

Blowing  Leak 

Functional  Flow 
Diagram 

GSE 

Hydrogen  Slush 
(Slush  Hydrogen) 

Propellant  Logistics 
System 

Modular  Transfer 
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That  part  of  the  Depot  containing  the 
Docking  Ports 

Those  Docking  Ports  to  which  segments  that 
comprise  the  Depot  are  docked. 

Those  Docking  Ports  made  up  of  large 
structural  mechanism  to  which  user  and 
supplier  vehicles  are  connected  for 
servicing 

Docking  by  use  of  manipulators 

Docking  by  allgiunent  of  docking  elements 
by  use  of  propulsive  devices 

Loading  propellants,  where  the  oxidizer  is 
loaded  first  and  fuel  is  loaded  second  in  a 
non-overlapping  time  interval 

Loading  both  oxidizer  and  fuel  during  the 
same  time  interval 

The  net  volume  of  the  cargo  bay,  minus  the 
colume  of  the  cargo.  This  is  the  volume 
that  is  available  in  which  to  mix  the  leaking 
hydrogen  with  air  to  form  reaction  mixture, 

A leak  that  exceeds  allowable  or  specification 
limits 

A map  of  events  leading  to  an  end,  showing 
the  sequence  and  interrelationships  of  events 
to  accomplish  the  end. 

Ground  Support  Equipment 

A mixture  of  small,  solid  hydrogen  particles 
suspended  in  liquid  hydrogen  at  the  triple 
point. 

That  system  which  Incorporates  the  transport 
from  ground  to  space,  transfer,  and  orbital 
storage  (if  required)  for  the  purpose  of 
propellant  resupply  of  space-based  user 
vehicles . 

The  package  exchange  of  cargo  (fluids);  i.e., 
the  replacement  of  an  empty  tank  by  a like 
tank  that  is  full. 
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Orbital  Storage 


Sortie  Module 
(Manned,  Free-flying) 


Liquid/Vapor  Interface 
Control 

Propellant  Logistics 
Module 


Storage 

Timelines 


Transfer 


Sometimes  referred  to  as  storage.  The 
accumulation  and  maintenance  (saving)  of 
fluid  in  earth  orbit  for  subsequent  transfer 
to  a user  vehicle. 

A reusable  space  laboratory  that  will  house 
personnel  while  they  conduct  short-duration 
experiments  in  earth  orbit. 

Management  of  the  position  in  the  tanks  of 
the  liquid  to  vapor  boundaries 

Propellant  tank  and  associated  hardware 
fitting  the  shuttle  orbiter  cargo  bay  and 
employed  for  transporting  propellant  to  the 
user  vehicles 

See  orbital  storage 

A sequence  of  activities  in  a mission  with 
start  and  stop  times  (duration)  of  the 
activity  defined. 

The  exchange  of  propellant  or  fluid  from  one 
vehicle  or  spacecraft  to  another  vehicle  or 
spacecraft. 


Tug 


User  Vehicle 


Rotational  Propellant 
Transfer 


Linear  Propellant 
Transfer 


Upper  stage  vehicle  sized  to  be  transported 
to  earth  orbit  by  a space  shuttle  orbiter. 

A space-based  spacecraft  which  requires 
propellant  refueling  or  makeup  of  life 
support  fluids  in  earth  orbit. 

Rotation  of  the  propellant  source  tank  and 
receiver  tank  about  a pitch  axis  to  settle 
propellants  by  the  resulting  acceleration 
forces  and  permit  fluid  pumping. 

Acceleration  of  source  tank  and  receiver 
tank  in  X axis  direction  and  permit  fluid 
pumping. 
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